nodejs / uvwasi

WASI syscall API built atop libuv
MIT License
226 stars 51 forks source link

Should not be able to create a symlink to absolute path #271

Closed yagehu closed 3 months ago

yagehu commented 3 months ago

WASI specifies that such an operation should fail. Node with uvwasi currently successfully creates the symlink. Other runtimes (Wasmtime, Wasmer, WasmEdge, Wazero, WAMR) successfully block this call.

fn main() {
    unsafe {
        let base_fd = 3;

        wasi::path_symlink("/a", base_fd, "a").unwrap();
    }
}