From bf184d2be6df9c772ec3a47b0b201e814880b18e Mon Sep 17 00:00:00 2001 From: Marcono1234 Date: Wed, 22 Jul 2026 17:40:45 +0200 Subject: [PATCH 1/3] Improve WASI `inheritSystem()` documentation --- docs/docs/experimental/cli.md | 2 +- docs/docs/security/best-practices.md | 7 ++++--- wasi/src/main/java/run/endive/wasi/WasiOptions.java | 3 +++ 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/docs/docs/experimental/cli.md b/docs/docs/experimental/cli.md index 968ecb7fb..bf576d338 100644 --- a/docs/docs/experimental/cli.md +++ b/docs/docs/experimental/cli.md @@ -6,7 +6,7 @@ title: CLI # Install and use the CLI :::warning[Security Consideration] -The experimental CLI uses `inheritSystem()` by default, granting the Wasm module full access to the host filesystem, environment, and stdio. Do not use it with untrusted modules in its current form. +The experimental CLI uses `inheritSystem()` by default, granting the Wasm module access to stdin, stdout and stderr of the host. Do not use it with untrusted modules in its current form. ::: The experimental Endive CLI is available for download on Maven at the link: diff --git a/docs/docs/security/best-practices.md b/docs/docs/security/best-practices.md index 269ffe73c..4b0d0c671 100644 --- a/docs/docs/security/best-practices.md +++ b/docs/docs/security/best-practices.md @@ -49,12 +49,13 @@ WASI file access does not enforce path sandboxing by default. Passing the host f var options = WasiOptions.builder() // Use ZeroFs to restrict access to specific directories .withDirectory("/guest/data", zeroFs.getPath("/host/sandboxed/data")) - .withStdout(myStdout) - .withStderr(myStderr) .build(); ``` -**Never use `inheritSystem()` with untrusted modules** — it grants full host filesystem, environment, and stdio access. +**Provide only access to what is needed by the Wasm module, especially if it is untrusted:** +- Pass a virtual file system, and copy needed data to it in advance +- Pass only the needed environment variables and not all host environment variables +- Inherit the host stdin, stdout and stderr only if needed; alternatively provide a custom `InputStream` and `OutputStream` ## Resource Limits diff --git a/wasi/src/main/java/run/endive/wasi/WasiOptions.java b/wasi/src/main/java/run/endive/wasi/WasiOptions.java index f880b67be..a7dc4d89e 100644 --- a/wasi/src/main/java/run/endive/wasi/WasiOptions.java +++ b/wasi/src/main/java/run/endive/wasi/WasiOptions.java @@ -167,6 +167,9 @@ public Builder withStdin(InputStream stdin, boolean isTty) { return this; } + /** + * Inherits {@code System.in}, {@code System.out} and {@code System.err}. + */ public Builder inheritSystem() { this.stdout = System.out; this.stdin = System.in; From ff4fad88566604bb5734a7470a2ba70280288152 Mon Sep 17 00:00:00 2001 From: Marcono1234 Date: Thu, 23 Jul 2026 15:13:09 +0200 Subject: [PATCH 2/3] Rename `inheritSystem()` --- cli/src/main/java/run/endive/experimental/cli/Cli.java | 2 +- docs/docs/experimental/cli.md | 2 +- docs/docs/wasi/index.md | 2 +- .../test/java/run/endive/testing/ZigTestsuiteTest.java | 2 +- wabt/src/main/java/run/endive/wabt/Wast2Json.java | 2 +- wasi/src/main/java/run/endive/wasi/WasiOptions.java | 10 +++++++++- .../src/main/java/run/endive/tools/wasm/Wast2Json.java | 2 +- 7 files changed, 15 insertions(+), 7 deletions(-) diff --git a/cli/src/main/java/run/endive/experimental/cli/Cli.java b/cli/src/main/java/run/endive/experimental/cli/Cli.java index c0012cd13..0bde54104 100644 --- a/cli/src/main/java/run/endive/experimental/cli/Cli.java +++ b/cli/src/main/java/run/endive/experimental/cli/Cli.java @@ -62,7 +62,7 @@ public void run() { WasiPreview1.builder() .withOptions( WasiOptions.builder() - .inheritSystem() + .inheritSystemStreams() .build()) .build() .toHostFunctions()) diff --git a/docs/docs/experimental/cli.md b/docs/docs/experimental/cli.md index bf576d338..df42749fa 100644 --- a/docs/docs/experimental/cli.md +++ b/docs/docs/experimental/cli.md @@ -6,7 +6,7 @@ title: CLI # Install and use the CLI :::warning[Security Consideration] -The experimental CLI uses `inheritSystem()` by default, granting the Wasm module access to stdin, stdout and stderr of the host. Do not use it with untrusted modules in its current form. +The experimental CLI uses `inheritSystemStreams()` by default, granting the Wasm module access to stdin, stdout and stderr of the host. Do not use it with untrusted modules in its current form. ::: The experimental Endive CLI is available for download on Maven at the link: diff --git a/docs/docs/wasi/index.md b/docs/docs/wasi/index.md index 12a209ea3..5499a5b91 100644 --- a/docs/docs/wasi/index.md +++ b/docs/docs/wasi/index.md @@ -147,7 +147,7 @@ var wasi = WasiOptions.builder().withStdout(System.out).withStderr(System.err).w a convenient shorthand for doing the same is: ```java -var wasi = WasiOptions.builder().inheritSystem().build() +var wasi = WasiOptions.builder().inheritSystemStreams().build() ``` ## arguments diff --git a/nightly-testsuite/src/test/java/run/endive/testing/ZigTestsuiteTest.java b/nightly-testsuite/src/test/java/run/endive/testing/ZigTestsuiteTest.java index d143b8d6f..0808a8fec 100644 --- a/nightly-testsuite/src/test/java/run/endive/testing/ZigTestsuiteTest.java +++ b/nightly-testsuite/src/test/java/run/endive/testing/ZigTestsuiteTest.java @@ -24,7 +24,7 @@ public void shouldRunZigStdlibTestsuite() throws Exception { var wasiOpts = WasiOptions.builder() - .inheritSystem() + .inheritSystemStreams() .withArguments(List.of("test.wasm")) .withDirectory(target.toString(), target) .build(); diff --git a/wabt/src/main/java/run/endive/wabt/Wast2Json.java b/wabt/src/main/java/run/endive/wabt/Wast2Json.java index 200261d3f..a81fbfb12 100644 --- a/wabt/src/main/java/run/endive/wabt/Wast2Json.java +++ b/wabt/src/main/java/run/endive/wabt/Wast2Json.java @@ -55,7 +55,7 @@ public void process() { .build())) { var wasiOpts = WasiOptions.builder(); - wasiOpts.inheritSystem(); + wasiOpts.inheritSystemStreams(); Path inputFolder = fs.getPath("input"); java.nio.file.Files.createDirectory(inputFolder); diff --git a/wasi/src/main/java/run/endive/wasi/WasiOptions.java b/wasi/src/main/java/run/endive/wasi/WasiOptions.java index a7dc4d89e..f6c29eb59 100644 --- a/wasi/src/main/java/run/endive/wasi/WasiOptions.java +++ b/wasi/src/main/java/run/endive/wasi/WasiOptions.java @@ -170,13 +170,21 @@ public Builder withStdin(InputStream stdin, boolean isTty) { /** * Inherits {@code System.in}, {@code System.out} and {@code System.err}. */ - public Builder inheritSystem() { + public Builder inheritSystemStreams() { this.stdout = System.out; this.stdin = System.in; this.stderr = System.err; return this; } + /** + * @deprecated renamed to {@link #inheritSystemStreams()} + */ + @Deprecated + public Builder inheritSystem() { + return inheritSystemStreams(); + } + public Builder withArguments(List arguments) { this.arguments = List.copyOf(arguments); return this; diff --git a/wasm-tools/src/main/java/run/endive/tools/wasm/Wast2Json.java b/wasm-tools/src/main/java/run/endive/tools/wasm/Wast2Json.java index 4306503f3..7bcfbae8f 100644 --- a/wasm-tools/src/main/java/run/endive/tools/wasm/Wast2Json.java +++ b/wasm-tools/src/main/java/run/endive/tools/wasm/Wast2Json.java @@ -57,7 +57,7 @@ public void process() { var wasiOpts = WasiOptions.builder(); - wasiOpts.inheritSystem(); + wasiOpts.inheritSystemStreams(); Path inputFolder = fs.getPath("input"); java.nio.file.Files.createDirectory(inputFolder); From 68ee7bf61564fb5bd422264092bd7e67e2607ef2 Mon Sep 17 00:00:00 2001 From: Marcono1234 Date: Thu, 23 Jul 2026 16:13:38 +0200 Subject: [PATCH 3/3] Suppress InlineMe warning --- wasi/src/main/java/run/endive/wasi/WasiOptions.java | 1 + 1 file changed, 1 insertion(+) diff --git a/wasi/src/main/java/run/endive/wasi/WasiOptions.java b/wasi/src/main/java/run/endive/wasi/WasiOptions.java index f6c29eb59..007e12dbd 100644 --- a/wasi/src/main/java/run/endive/wasi/WasiOptions.java +++ b/wasi/src/main/java/run/endive/wasi/WasiOptions.java @@ -181,6 +181,7 @@ public Builder inheritSystemStreams() { * @deprecated renamed to {@link #inheritSystemStreams()} */ @Deprecated + @SuppressWarnings("InlineMeSuggester") public Builder inheritSystem() { return inheritSystemStreams(); }