Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: generic error message for file load #377

Merged
merged 2 commits into from
Dec 5, 2024

Conversation

staaldraad
Copy link

What kind of change does this PR introduce?

Bug fix

What is the current behavior?

When loading a wasm file (from the local filesystem), the error message could be used to enumerate files on the filesystem.

File exists - /etc/passwd

wrappers=# select * from wasm_out;
ERROR:  wasmtime error: failed to parse WebAssembly module

No such file - /etc/nop

wrappers=# select * from wasm_out;
ERROR:  wasmtime error: failed to read input file: /etc/nop

What is the new behavior?

Gives a generic error message for file load failures to prevent file system enumeration.

File exists - /etc/passwd

wrappers=# select * from wasm_out;
ERROR:  wasmtime error: failed to parse WebAssembly module

No such file - /etc/nop

wrappers=# select * from wasm_out;
ERROR:  wasmtime error: failed to parse WebAssembly module

Additional context

Add any other context or screenshots.

Give a generic error message for file load failures to prevent file
system enumeration.
@staaldraad staaldraad requested a review from burmecia December 4, 2024 14:07
Copy link
Member

@burmecia burmecia left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the PR! I've made the error specific for the Wasm component load failure, so its error message won't leak filesystem info.

@burmecia burmecia merged commit 8a30794 into main Dec 5, 2024
3 checks passed
@burmecia burmecia deleted the chore/generic-error-fileload branch December 5, 2024 01:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants