search

nearprotocol / assemblyscript-bson

BSON encoder / decoder for AssemblyScript
https://nearprotocol.com
MIT License
34 stars 0 forks source link

Is it secure? #2

Open KOLANICH opened 5 years ago

KOLANICH commented 5 years ago

https://github.com/WebAssembly/design/blob/master/Security.md

Although attackers cannot perform direct code injection attacks, it is possible to hijack the control flow of a module using code reuse attacks against indirect calls.

vgrichina commented 5 years ago

Parser should be safe from buffer overruns as it's reads binary data from Uint8Buffer, which implements boundary checks: https://github.com/AssemblyScript/assemblyscript/blob/master/std/assembly/internal/typedarray.ts#L50

However note that its would still result in crash (of WA guest), so depending on your app attacker can be doing denial of service attack by sending invalid BSON.

It's not a problem in case of smart contracts for https://github.com/nearprotocol/nearcore, cause they are expected to have short execution time and fail fast on errors.