The node:wasi module does not currently provide the\ncomprehensive file system security properties provided by some WASI runtimes.\nFull support for secure file system sandboxing may or may not be implemented in\nfuture. In the mean time, do not rely on it to run untrusted code.
Source Code: lib/wasi.js
\nThe WASI API provides an implementation of the WebAssembly System Interface\nspecification. WASI gives WebAssembly applications access to the underlying\noperating system via a collection of POSIX-like functions.
\nimport { readFile } from 'node:fs/promises';\nimport { WASI } from 'node:wasi';\nimport { argv, env } from 'node:process';\n\nconst wasi = new WASI({\n version: 'preview1',\n args: argv,\n env,\n preopens: {\n '/local': '/some/real/path/that/wasm/can/access',\n },\n});\n\nconst wasm = await WebAssembly.compile(\n await readFile(new URL('./demo.wasm', import.meta.url)),\n);\nconst instance = await WebAssembly.instantiate(wasm, wasi.getImportObject());\n\nwasi.start(instance);\n'use strict';\nconst { readFile } = require('node:fs/promises');\nconst { WASI } = require('node:wasi');\nconst { argv, env } = require('node:process');\nconst { join } = require('node:path');\n\nconst wasi = new WASI({\n version: 'preview1',\n args: argv,\n env,\n preopens: {\n '/local': '/some/real/path/that/wasm/can/access',\n },\n});\n\n(async () => {\n const wasm = await WebAssembly.compile(\n await readFile(join(__dirname, 'demo.wasm')),\n );\n const instance = await WebAssembly.instantiate(wasm, wasi.getImportObject());\n\n wasi.start(instance);\n})();\nTo run the above example, create a new WebAssembly text format file named\ndemo.wat:
(module\n ;; Import the required fd_write WASI function which will write the given io vectors to stdout\n ;; The function signature for fd_write is:\n ;; (File Descriptor, *iovs, iovs_len, nwritten) -> Returns number of bytes written\n (import \"wasi_snapshot_preview1\" \"fd_write\" (func $fd_write (param i32 i32 i32 i32) (result i32)))\n\n (memory 1)\n (export \"memory\" (memory 0))\n\n ;; Write 'hello world\\n' to memory at an offset of 8 bytes\n ;; Note the trailing newline which is required for the text to appear\n (data (i32.const 8) \"hello world\\n\")\n\n (func $main (export \"_start\")\n ;; Creating a new io vector within linear memory\n (i32.store (i32.const 0) (i32.const 8)) ;; iov.iov_base - This is a pointer to the start of the 'hello world\\n' string\n (i32.store (i32.const 4) (i32.const 12)) ;; iov.iov_len - The length of the 'hello world\\n' string\n\n (call $fd_write\n (i32.const 1) ;; file_descriptor - 1 for stdout\n (i32.const 0) ;; *iovs - The pointer to the iov array, which is stored at memory location 0\n (i32.const 1) ;; iovs_len - We're printing 1 string stored in an iov - so one.\n (i32.const 20) ;; nwritten - A place in memory to store the number of bytes written\n )\n drop ;; Discard the number of bytes written from the top of the stack\n )\n)\nUse wabt to compile .wat to .wasm
wat2wasm demo.wat\nWASI provides a capabilities-based model through which applications are provided\ntheir own custom env, preopens, stdin, stdout, stderr, and exit\ncapabilities.
The current Node.js threat model does not provide secure sandboxing as is\npresent in some WASI runtimes.
\nWhile the capability features are supported, they do not form a security model\nin Node.js. For example, the file system sandboxing can be escaped with various\ntechniques. The project is exploring whether these security guarantees could be\nadded in future.
", "type": "module", "displayName": "Security" } ], "classes": [ { "textRaw": "Class: `WASI`", "type": "class", "name": "WASI", "meta": { "added": [ "v13.3.0", "v12.16.0" ], "changes": [] }, "desc": "The WASI class provides the WASI system call API and additional convenience\nmethods for working with WASI-based applications. Each WASI instance\nrepresents a distinct environment.
Return an import object that can be passed to WebAssembly.instantiate() if\nno other WASM imports are needed beyond those provided by WASI.
If version unstable was passed into the constructor it will return:
{ wasi_unstable: wasi.wasiImport }\nIf version preview1 was passed into the constructor or no version was\nspecified it will return:
{ wasi_snapshot_preview1: wasi.wasiImport }\nAttempt to begin execution of instance as a WASI command by invoking its\n_start() export. If instance does not contain a _start() export, or if\ninstance contains an _initialize() export, then an exception is thrown.
start() requires that instance exports a WebAssembly.Memory named\nmemory. If instance does not have a memory export an exception is thrown.
If start() is called more than once, an exception is thrown.
Attempt to initialize instance as a WASI reactor by invoking its\n_initialize() export, if it is present. If instance contains a _start()\nexport, then an exception is thrown.
initialize() requires that instance exports a WebAssembly.Memory named\nmemory. If instance does not have a memory export an exception is thrown.
If initialize() is called more than once, an exception is thrown.
wasiImport is an object that implements the WASI system call API. This object\nshould be passed as the wasi_snapshot_preview1 import during the instantiation\nof a WebAssembly.Instance.