WebAssembly (or wasm) is a binary instruction format designed to run in a virtual machine in the browser.
Questions tagged [web-assembly]
6 questions
5
votes
1 answer
Web Assembly Security
I'm excited about the prospects of web-assembly for the future, but I'm curious if this will have the same security ramifications of Java Applets.
What are some of the reasons why web assembly is expected to be more secure than Java Applets?
(Isn't…
JacKeown
- 153
- 4
4
votes
1 answer
Does CORS interact with WebAssembly the same way it does with Javascript?
Anyone in the WebAppSec world is familiar with CORS as a mechanism to specify policy for when javascript is allowed to make API calls to different domains. As WebAssembly ("Wasm" - a binary web language standardized in 2019; webassembly.org,…
Mike Ounsworth
- 57,707
- 21
- 150
- 207
3
votes
2 answers
A runtime sometimes converts string arguments (or string returns) from WTF-16 to UTF-16 between functions in a call stack. Is this a security concern?
Suppose that we have this code (in TypeScript syntax):
function one(str: string): string {
// do something with the string
return str
}
function two() {
let s = getSomeString() // returns some unknown string that may contain surrogates
s =…
trusktr
- 61
- 9
3
votes
1 answer
Can WebAssembly execution be disabled in browsers?
I've recently found out about this new technology, which recently became a World Wide Web Consortium recommendation and also that now almost all main browsers support it and it is enabled by default, see e.g. this.
I was not able to find in e.g.…
Alexei Martianov
- 159
- 4
0
votes
0 answers
Need a cross-platform method of generating near truly random numbers
I have been working on an app that uses a combination of different encryption methods; some of them are libraries, and the most important ones are my own implementations. The app is cross-platform that are compiled natively on desktop (Linux,…
mike yang yang
- 1
- 1
0
votes
0 answers
securing webassembly/WasmEdge - any 0-day exploits so far and devsecops pipeline targetted at webassembly?
I am looking to deploy webassembly at scale in production. Before I do so, like to know if there are any 0-day exploits so far and if there are devsecops tools pipeline specifically targetted at webassembly?
Nathan Aw
- 1
- 7
- 12