nodejs / uvwasi

WASI syscall API built atop libuv
MIT License
226 stars 51 forks source link

uvwasi accepts malformed path containing null byte #265

Closed yagehu closed 4 months ago

yagehu commented 4 months ago

Calling path_open in uvwasi with a path that contains null byte does not error. Here's an example:

fn main() {
    unsafe {
        let bytes = [18u8, 110u8, 0];
        let path = String::from_utf8(bytes.to_vec()).unwrap();
        let fd = wasi::path_open(
            3,
            0,
            &path,
            wasi::OFLAGS_CREAT | wasi::OFLAGS_EXCL | wasi::OFLAGS_TRUNC,
            wasi::RIGHTS_FD_READ | wasi::RIGHTS_FD_WRITE | wasi::RIGHTS_FD_SEEK,
            0,
            wasi::FDFLAGS_APPEND | wasi::FDFLAGS_NONBLOCK,
        )
        .unwrap();

        eprintln!("fd: {errno}");
    }
}

This Rust example depends on wasi crate v0.11.

On other runtimes, this example fails with inval. But Node succeeds, creating a file with a 2-byte filename.