Rename WASI inheritSystem() and improve documentation

cli/src/main/java/run/endive/experimental/cli/Cli.java

@@ -62,7 +62,7 @@ public void run() {
                                         WasiPreview1.builder()
                                                 .withOptions(
                                                         WasiOptions.builder()
-                                                                .inheritSystem()
+                                                                .inheritSystemStreams()
                                                                 .build())
                                                 .build()
                                                 .toHostFunctions())

docs/docs/experimental/cli.md

@@ -6,7 +6,7 @@ title: CLI
 # Install and use the CLI
 
 :::warning[Security Consideration]
-The experimental CLI uses `inheritSystem()` by default, granting the Wasm module full access to the host filesystem, environment, and stdio. Do not use it with untrusted modules in its current form.
+The experimental CLI uses `inheritSystemStreams()` by default, granting the Wasm module access to stdin, stdout and stderr of the host. Do not use it with untrusted modules in its current form.
 :::
 
 The experimental Endive CLI is available for download on Maven at the link:

docs/docs/security/best-practices.md

@@ -49,12 +49,13 @@ WASI file access does not enforce path sandboxing by default. Passing the host f
 var options = WasiOptions.builder()
         // Use ZeroFs to restrict access to specific directories
         .withDirectory("/guest/data", zeroFs.getPath("/host/sandboxed/data"))
-        .withStdout(myStdout)
-        .withStderr(myStderr)
         .build();
 ```
 
-**Never use `inheritSystem()` with untrusted modules** — it grants full host filesystem, environment, and stdio access.
+**Provide only access to what is needed by the Wasm module, especially if it is untrusted:**
+- Pass a virtual file system, and copy needed data to it in advance 
+- Pass only the needed environment variables and not all host environment variables
+- Inherit the host stdin, stdout and stderr only if needed; alternatively provide a custom `InputStream` and `OutputStream`
 
 ## Resource Limits
 

docs/docs/wasi/index.md

@@ -147,7 +147,7 @@ var wasi = WasiOptions.builder().withStdout(System.out).withStderr(System.err).w
 a convenient shorthand for doing the same is:
 
 ```java
-var wasi = WasiOptions.builder().inheritSystem().build()
+var wasi = WasiOptions.builder().inheritSystemStreams().build()
 ```
 
 ## arguments

nightly-testsuite/src/test/java/run/endive/testing/ZigTestsuiteTest.java

@@ -24,7 +24,7 @@ public void shouldRunZigStdlibTestsuite() throws Exception {
 
             var wasiOpts =
                     WasiOptions.builder()
-                            .inheritSystem()
+                            .inheritSystemStreams()
                             .withArguments(List.of("test.wasm"))
                             .withDirectory(target.toString(), target)
                             .build();

wabt/src/main/java/run/endive/wabt/Wast2Json.java

@@ -55,7 +55,7 @@ public void process() {
                                         .build())) {
 
             var wasiOpts = WasiOptions.builder();
-            wasiOpts.inheritSystem();
+            wasiOpts.inheritSystemStreams();
 
             Path inputFolder = fs.getPath("input");
             java.nio.file.Files.createDirectory(inputFolder);

wasi/src/main/java/run/endive/wasi/WasiOptions.java

@@ -167,13 +167,25 @@ public Builder withStdin(InputStream stdin, boolean isTty) {
             return this;
         }
 
-        public Builder inheritSystem() {
+        /**
+         * Inherits {@code System.in}, {@code System.out} and {@code System.err}.
+         */
+        public Builder inheritSystemStreams() {
             this.stdout = System.out;
             this.stdin = System.in;
             this.stderr = System.err;
             return this;
         }
 
+        /**
+         * @deprecated renamed to {@link #inheritSystemStreams()}
+         */
+        @Deprecated
+        @SuppressWarnings("InlineMeSuggester")
+        public Builder inheritSystem() {
+            return inheritSystemStreams();
+        }
+
         public Builder withArguments(List<String> arguments) {
             this.arguments = List.copyOf(arguments);
             return this;

wasm-tools/src/main/java/run/endive/tools/wasm/Wast2Json.java

@@ -57,7 +57,7 @@ public void process() {
 
             var wasiOpts = WasiOptions.builder();
 
-            wasiOpts.inheritSystem();
+            wasiOpts.inheritSystemStreams();
 
             Path inputFolder = fs.getPath("input");
             java.nio.file.Files.createDirectory(inputFolder);