search

polywrap / wrap-cli

Used to create, build, and integrate wraps.
https://polywrap.io
MIT License
170 stars 53 forks source link

A More Secure CLI #608

Open dOrgJelli opened 2 years ago

dOrgJelli commented 2 years ago

Currently the CLI is written in TypeScript (JavaScript), and run using the Node.JS runtime. This is not a secure long-term solution, due to Node.JS's vulnerabilities.

A possible solution could be re-writing the CLI in a native targeting language such as Rust.

dOrgJelli commented 2 years ago

It's recently come to our attention (thank you @nerfZael) that the best route forward in the short-term is to move all major functionality from the CLI into wrappers. This will reduce our dependency footprint in JS, and allow us to permission access to the user's operating system (filesystem, network, etc) through plugins.

@nerfZael it would be great if you could post links to some of your early "science experiments" you've created for the wrapper based codegen & project templates.

nerfZael commented 2 years ago

The idea is talked about here: https://hackmd.io/@nerfZael/HkXtaZX1q Still needs to be fleshed out a bit more. I'll also post the codegen wrappers when I get the opportunity