WASM Sandbox Security

┌─────────────────────────────────────────────────────────────────┐
│                    WASM Tool Execution                          │
│                                                                  │
│   WASM Tool ──► Host Function ──► Allowlist ──► Credential     │
│   (untrusted)   (boundary)        Validator     Injector        │
│                                                      │           │
│                                                      ▼           │
│                                                  Execute         │
│                                                  Request         │
│                                                      │           │
│                                                      ▼           │
│                               ◄──── Leak Detector ◄─ Response   │
│                          (sanitized, no secrets)                │
└─────────────────────────────────────────────────────────────────┘

pub const DEFAULT_MEMORY_LIMIT: usize = 10 * 1024 * 1024; // 10 MB

impl ResourceLimiter for WasmResourceLimiter {
    fn memory_growing(
        &mut self,
        current: usize,
        desired: usize,
        _maximum: Option<usize>,
    ) -> Result<bool> {
        if desired > self.max_memory {
            return Ok(false); // Deny growth beyond limit
        }
        Ok(true)
    }
}

// Default fuel limit (approx 10M instructions)
pub const DEFAULT_FUEL_LIMIT: u64 = 10_000_000;

// Configure in engine
config.consume_fuel(true);
store.add_fuel(fuel_config.initial_fuel)?;

// Check remaining fuel during execution
let remaining = store.get_fuel()?;

// Compile once during registration
let module = engine.compile(wasm_bytes)?;
let prepared = PreparedModule { module, ... };

// Fresh instance per execution
let instance = linker.instantiate(&mut store, &prepared.module)?;

{
  "http": {
    "allowlist": [
      {
        "host": "api.openai.com",
        "path_prefix": "/v1/",
        "methods": ["POST"]
      }
    ],
    "rate_limit": {
      "requests_per_minute": 60,
      "requests_per_hour": 1000
    }
  },
  "secrets": {
    "allowed_names": ["openai_api_key"]
  },
  "workspace_read": {
    "allowed_prefixes": ["context/", "daily/"]
  }
}

pub struct HttpCapability {
    pub allowlist: Vec<EndpointPattern>,
    pub credentials: HashMap<String, CredentialMapping>,
    pub rate_limit: RateLimitConfig,
    pub max_request_bytes: usize,   // Default: 1 MB
    pub max_response_bytes: usize,  // Default: 10 MB
    pub timeout: Duration,          // Default: 30s
}

// WASM can call
let exists = host.secret_exists("openai_api_key"); // true/false

// WASM cannot call (not exposed)
let value = host.get_secret("openai_api_key"); // ❌ Not available

// Allowed (if "context/" prefix is granted)
let content = workspace_read("context/notes.md");

// Blocked (prefix not in allowed list)
let content = workspace_read("secrets/api_keys.txt"); // ❌ Access denied

// Blocked (path traversal)
let content = workspace_read("../../../etc/passwd"); // ❌ Validation fails

fn validate_workspace_path(path: &str) -> Result<String, String> {
    // Block absolute paths
    if path.starts_with('/') {
        return Err("Absolute paths not allowed");
    }
    
    // Block path traversal
    if path.contains("..") {
        return Err("Parent directory references not allowed");
    }
    
    // Block null bytes
    if path.contains('\0') {
        return Err("Null bytes not allowed");
    }
    
    Ok(path)
}

{
  "tool_invoke": {
    "aliases": {
      "search": "web_search_tool",
      "summarize": "summarization_tool"
    }
  }
}

fn log(level: i32, message_ptr: i32, message_len: i32)

fn now_millis() -> i64

fn workspace_read(path_ptr: i32, path_len: i32) -> i32  // Returns result handle

fn http_request(
    method_ptr: i32, method_len: i32,
    url_ptr: i32, url_len: i32,
    headers_ptr: i32, headers_len: i32,
    body_ptr: i32, body_len: i32
) -> i32  // Returns result handle

fn secret_exists(name_ptr: i32, name_len: i32) -> i32  // 1 = exists, 0 = not found

fn tool_invoke(
    alias_ptr: i32, alias_len: i32,
    params_ptr: i32, params_len: i32
) -> i32  // Returns result handle

match instance.execute(&mut store, params) {
    Ok(result) => result,
    Err(e) if e.is_wasm_trap() => {
        tracing::error!(tool = tool_name, "WASM trap: {}", e);
        return Err(WasmError::Trap { ... });
    }
}

WasmError::OutOfFuel {
    tool: "expensive_tool",
    fuel_used: 10000000,
}

WasmError::MemoryLimitExceeded {
    tool: "greedy_tool",
    attempted: 15_000_000,
    limit: 10_000_000,
}

WasmError::CapabilityDenied {
    tool: "sneaky_tool",
    capability: "http",
    reason: "Host not in allowlist: evil.com",
}