@bytecodealliance/preview2-shim 0.26.0 → 0.27.0

package/README.md

@@ -107,8 +107,7 @@ const shim = new WASIShim({
 ```
 
 This keeps permission prompts, handle acquisition, persistence, and synchronization policy in
-application code. Raw TCP, UDP, and DNS are denied by default; outbound HTTP remains a separate
-`fetch` capability.
+application code. `sandbox.enableNetwork: false` denies raw TCP, UDP, DNS, and outbound HTTP.
 
 Deterministic in-memory transports are available for components that act as servers and for tests:
 
@@ -240,9 +239,8 @@ const component = await instantiate(loader, sandboxedShim.getImportObject());
 - The direct preopen functions (`_setPreopens`, `_clearPreopens`, etc.) modify global state and
   affect all components not using `WASIShim` with explicit configuration. For isolation, prefer
   using `WASIShim` with the `sandbox` option containing `preopens` and `env`.
-- When `sandbox.enableNetwork: false`, Node.js socket operations receive an instance-local denied
-  network capability. Outbound HTTP is a separate Fetch capability; replace or omit the HTTP
-  namespace when the embedding must deny it as well.
+- When `sandbox.enableNetwork: false`, socket operations and outbound HTTP receive instance-local
+  denied network capabilities.
 
 [jco]: https://www.npmjs.com/package/@bytecodealliance/jco
 

package/dist/common/instantiation.js

@@ -180,6 +180,17 @@ export class WASIShim {
             };
         }
         this.#http = shims?.http ?? wasi.http;
+        if (sandbox?.enableNetwork === false) {
+            this.#http = {
+                ...this.#http,
+                outgoingHandler: {
+                    ...this.#http.outgoingHandler,
+                    handle() {
+                        throw "access-denied";
+                    },
+                },
+            };
+        }
         if (shims?.incomingHandler) {
             if (!this.#http.createIncomingHandler) {
                 throw new TypeError("the selected HTTP shim does not support Web incoming handlers");

package/dist/nodejs/filesystem.d.ts

@@ -95,11 +95,10 @@ export declare function _setPreopens(preopens: any): void;
 export declare function _addPreopen(virtualPath: any, hostPreopen: any): void;
 /**
  * Clear all preopens, giving the guest no filesystem access.
- * Call this immediately after import to disable default full filesystem access.
  *
  * @example
  * import { _clearPreopens } from '@bytecodealliance/preview2-shim/filesystem';
- * _clearPreopens(); // Now guest has no filesystem access by default
+ * _clearPreopens();
  */
 export declare function _clearPreopens(): void;
 /**

package/dist/nodejs/filesystem.js

@@ -1,10 +1,16 @@
 import { earlyDispose, inputStreamCreate, ioCall, outputStreamCreate, registerDispose, } from "../io/worker-io.js";
 import { FILE, FILESYSTEM_DESCRIPTOR_ADVISE, FILESYSTEM_DESCRIPTOR_CLOSE, FILESYSTEM_DESCRIPTOR_GET_TYPE, FILESYSTEM_DESCRIPTOR_METADATA_HASH, FILESYSTEM_DESCRIPTOR_OPEN, FILESYSTEM_DESCRIPTOR_READ, FILESYSTEM_DESCRIPTOR_SET_SIZE, FILESYSTEM_DESCRIPTOR_SET_TIMES, FILESYSTEM_DESCRIPTOR_STAT, FILESYSTEM_DESCRIPTOR_SYNC, FILESYSTEM_DESCRIPTOR_SYNC_DATA, FILESYSTEM_DESCRIPTOR_WRITE, INPUT_STREAM_CREATE, OUTPUT_STREAM_CREATE, } from "../io/calls.js";
 import { constants, linkSync, lstatSync, lutimesSync, mkdirSync, opendirSync, readlinkSync, realpathSync, renameSync, rmdirSync, statSync, symlinkSync, unlinkSync, utimesSync, } from "node:fs";
+import { posix, win32 } from "node:path";
 import { platform } from "node:process";
 const symbolDispose = Symbol.dispose || Symbol.for("dispose");
 const isWindows = platform === "win32";
 const isMac = platform === "darwin";
+const hostPath = isWindows ? win32 : posix;
+const MAX_SYMLINKS = 40;
+function normalizeHostPath(path) {
+    return isWindows ? path.replace(/\\/g, "/") : path;
+}
 const nsMagnitude = 1000000000n;
 function nsToDateTime(ns) {
     const seconds = ns / nsMagnitude;
@@ -226,7 +232,7 @@ class Descriptor {
         }
     }
     createDirectoryAt(path) {
-        const fullPath = this.#getFullPath(path);
+        const fullPath = this.#getFullPath(path, false);
         try {
             mkdirSync(fullPath);
         }
@@ -256,7 +262,7 @@ class Descriptor {
         };
     }
     statAt(pathFlags, path) {
-        const fullPath = this.#getFullPath(path);
+        const fullPath = this.#getFullPath(path, pathFlags.symlinkFollow);
         let stats;
         try {
             stats = (pathFlags.symlinkFollow ? statSync : lstatSync)(fullPath, {
@@ -277,7 +283,7 @@ class Descriptor {
         };
     }
     setTimesAt(pathFlags, path, dataAccessTimestamp, dataModificationTimestamp) {
-        const fullPath = this.#getFullPath(path);
+        const fullPath = this.#getFullPath(path, pathFlags.symlinkFollow);
         let stats;
         if (dataAccessTimestamp.tag === "no-change" ||
             dataModificationTimestamp.tag === "no-change") {
@@ -288,7 +294,7 @@ class Descriptor {
         if (!pathFlags.symlinkFollow && !lutimesSync) {
             throw new Error("Changing the timestamps of symlinks isn't supported");
         }
-        let metadataSetFn = pathFlags.symlinkFollow ? lutimesSync : utimesSync;
+        let metadataSetFn = pathFlags.symlinkFollow ? utimesSync : lutimesSync;
         try {
             metadataSetFn(fullPath, atime / 1000, mtime / 1000);
         }
@@ -297,42 +303,21 @@ class Descriptor {
         }
     }
     linkAt(oldPathFlags, oldPath, newDescriptor, newPath) {
-        const oldFullPath = this.#getFullPath(oldPath);
-        const newFullPath = newDescriptor.#getFullPath(newPath);
+        const oldFullPath = this.#getFullPath(oldPath, oldPathFlags.symlinkFollow);
+        const newFullPath = newDescriptor.#getFullPath(newPath, false);
         // Windows doesn't automatically fail on trailing slashes
         if (isWindows && newFullPath.endsWith("/")) {
             throw "no-entry";
         }
         try {
-            // Unlike open/stat, Node's link does not follow the final symlink.
-            // Resolve only this operation's source, propagating resolution errors
-            // instead of silently hard-linking a dangling or cyclic symlink.
-            let source = oldFullPath;
-            if (oldPathFlags.symlinkFollow) {
-                source = realpathSync(source);
-                // realpath strips trailing slashes; keep the caller's directory
-                // requirement so a regular-file source ending in '/' still fails.
-                if (oldFullPath.endsWith("/")) {
-                    // Windows may ignore a trailing slash even in linkSync.
-                    if (!statSync(source).isDirectory()) {
-                        throw "not-directory";
-                    }
-                    if (!source.endsWith("/")) {
-                        source += "/";
-                    }
-                }
-            }
-            linkSync(source, newFullPath);
+            linkSync(oldFullPath, newFullPath);
         }
         catch (e) {
             throw convertFsError(e);
         }
     }
     openAt(pathFlags, path, openFlags, descriptorFlags) {
-        if (preopenEntries.length === 0) {
-            throw "access";
-        }
-        const fullPath = this.#getFullPath(path);
+        const fullPath = this.#getFullPath(path, pathFlags.symlinkFollow);
         let fsOpenFlags = 0x0;
         if (openFlags.create) {
             fsOpenFlags |= constants.O_CREAT;
@@ -426,7 +411,7 @@ class Descriptor {
         }
     }
     readlinkAt(path) {
-        const fullPath = this.#getFullPath(path);
+        const fullPath = this.#getFullPath(path, false);
         try {
             const target = readlinkSync(fullPath);
             return isWindows ? target.replace(/\\/g, "/") : target;
@@ -436,7 +421,7 @@ class Descriptor {
         }
     }
     removeDirectoryAt(path) {
-        const fullPath = this.#getFullPath(path);
+        const fullPath = this.#getFullPath(path, false);
         try {
             rmdirSync(fullPath);
         }
@@ -448,8 +433,8 @@ class Descriptor {
         }
     }
     renameAt(oldPath, newDescriptor, newPath) {
-        const oldFullPath = this.#getFullPath(oldPath);
-        const newFullPath = newDescriptor.#getFullPath(newPath);
+        const oldFullPath = this.#getFullPath(oldPath, false);
+        const newFullPath = newDescriptor.#getFullPath(newPath, false);
         try {
             renameSync(oldFullPath, newFullPath);
         }
@@ -461,7 +446,7 @@ class Descriptor {
         }
     }
     symlinkAt(target, path) {
-        const fullPath = this.#getFullPath(path);
+        const fullPath = this.#getFullPath(path, false);
         if (target.startsWith("/")) {
             throw "not-permitted";
         }
@@ -490,7 +475,7 @@ class Descriptor {
         }
     }
     unlinkFileAt(path) {
-        const fullPath = this.#getFullPath(path);
+        const fullPath = this.#getFullPath(path, false);
         try {
             if (fullPath.endsWith("/")) {
                 let isDir = false;
@@ -532,7 +517,7 @@ class Descriptor {
         }
     }
     metadataHashAt(pathFlags, path) {
-        const fullPath = this.#getFullPath(path);
+        const fullPath = this.#getFullPath(path, pathFlags.symlinkFollow);
         try {
             const stats = (pathFlags.symlinkFollow ? statSync : lstatSync)(fullPath, {
                 bigint: true,
@@ -543,70 +528,100 @@ class Descriptor {
             throw convertFsError(e);
         }
     }
-    // Join paths lexically; each operation supplies its own symlink semantics.
-    #getFullPath(subpath) {
-        let descriptor = this;
-        if (subpath.indexOf("\\") !== -1) {
-            subpath = subpath.replace(/\\/g, "/");
-        }
-        if (subpath.indexOf("//") !== -1) {
-            subpath = subpath.replace(/\/\/+/g, "/");
-        }
-        if (subpath[0] === "/") {
+    #getFullPath(subpath, followFinalSymlink) {
+        subpath = subpath.replace(/\\/g, "/").replace(/\/\/+/g, "/");
+        if (subpath.startsWith("/")) {
             throw "not-permitted";
         }
-        // segment resolution
+        const trailingSlash = subpath.endsWith("/");
         const segments = [];
-        let segmentIndex = -1;
-        for (let i = 0; i < subpath.length; i++) {
-            // busy reading a segment - only terminate on '/'
-            if (segmentIndex !== -1) {
-                if (subpath[i] === "/") {
-                    segments.push(subpath.slice(segmentIndex, i + 1));
-                    segmentIndex = -1;
-                }
+        for (const segment of subpath.split("/")) {
+            if (segment === "" || segment === ".") {
                 continue;
             }
-            // new segment - check if it is relative
-            else if (subpath[i] === ".") {
-                // ../ segment
-                if (subpath[i + 1] === "." &&
-                    (subpath[i + 2] === "/" || i + 2 === subpath.length)) {
-                    if (segments.pop() === undefined) {
-                        throw "not-permitted";
-                    }
-                    i += 2;
-                    continue;
+            if (segment === "..") {
+                if (segments.pop() === undefined) {
+                    throw "not-permitted";
                 }
-                // ./ segment
-                else if (subpath[i + 1] === "/" || i + 1 === subpath.length) {
-                    i += 1;
-                    continue;
+            }
+            else {
+                segments.push(segment);
+            }
+        }
+        const base = this.#hostPreopen ?? this.#fullPath;
+        // The default Windows preopen intentionally represents every drive and
+        // UNC share, so there is no narrower host boundary to enforce.
+        if (isWindows && this.#hostPreopen === "//") {
+            const normalized = segments.join("/");
+            const fullPath = /^[a-zA-Z]:\//.test(normalized)
+                ? `//?/${normalized}`
+                : `//${normalized}`;
+            return trailingSlash && normalized ? `${fullPath}/` : fullPath;
+        }
+        let baseResolved;
+        try {
+            baseResolved = normalizeHostPath(realpathSync(base));
+        }
+        catch (error) {
+            throw convertFsError(error);
+        }
+        let current = baseResolved;
+        let pending = [...segments];
+        let followedSymlinks = 0;
+        while (pending.length > 0) {
+            const segment = pending.shift();
+            const candidate = normalizeHostPath(hostPath.join(current, segment));
+            let stats;
+            try {
+                stats = lstatSync(candidate);
+            }
+            catch (error) {
+                if (error.code === "ENOENT") {
+                    const unresolved = normalizeHostPath(hostPath.join(candidate, ...pending));
+                    return trailingSlash ? `${unresolved}/` : unresolved;
                 }
+                throw convertFsError(error);
+            }
+            const isFinal = pending.length === 0;
+            if (!stats.isSymbolicLink() || (isFinal && !followFinalSymlink && !trailingSlash)) {
+                current = candidate;
+                continue;
+            }
+            if (++followedSymlinks > MAX_SYMLINKS) {
+                throw "loop";
+            }
+            let target;
+            try {
+                target = readlinkSync(candidate);
+            }
+            catch (error) {
+                throw convertFsError(error);
             }
-            // it is the start of a new segment
-            while (subpath[i] === "/") {
-                i++;
+            let targetSegments;
+            if (hostPath.isAbsolute(target)) {
+                throw "not-permitted";
             }
-            segmentIndex = i;
-        }
-        // finish reading out the last segment
-        if (segmentIndex !== -1) {
-            segments.push(subpath.slice(segmentIndex));
-        }
-        subpath = segments.join("");
-        // The default Windows preopen represents all drives.
-        //
-        // Convert drive paths to namespaced paths so joining them to the preopen
-        // does not produce an invalid UNC server name such as //C:/Users/...
-        if (isWindows && descriptor.#hostPreopen === "//" && /^[a-zA-Z]:\//.test(subpath)) {
-            return "//?/" + subpath;
-        }
-        return descriptor.#hostPreopen
-            ? descriptor.#hostPreopen +
-                (descriptor.#hostPreopen.endsWith("/") ? "" : subpath.length > 0 ? "/" : "") +
-                subpath
-            : descriptor.#fullPath + (subpath.length > 0 ? "/" : "") + subpath;
+            else {
+                const relativeCurrent = hostPath.relative(baseResolved, current);
+                targetSegments = relativeCurrent ? relativeCurrent.split(hostPath.sep) : [];
+                for (const targetSegment of target.replace(/\\/g, "/").split("/")) {
+                    if (targetSegment === "" || targetSegment === ".") {
+                        continue;
+                    }
+                    if (targetSegment === "..") {
+                        if (targetSegments.pop() === undefined) {
+                            throw "not-permitted";
+                        }
+                    }
+                    else {
+                        targetSegments.push(targetSegment);
+                    }
+                }
+            }
+            pending = [...targetSegments, ...pending];
+            current = baseResolved;
+        }
+        return trailingSlash && current !== baseResolved ? `${current}/` : current;
     }
 }
 const descriptorCreatePreopen = Descriptor._createPreopen;
@@ -655,7 +670,6 @@ export const preopens = {
         return preopenEntries;
     },
 };
-_addPreopen("/", isWindows ? "//" : "/");
 export const types = {
     Descriptor,
     DirectoryEntryStream,
@@ -694,11 +708,10 @@ export function _addPreopen(virtualPath, hostPreopen) {
 }
 /**
  * Clear all preopens, giving the guest no filesystem access.
- * Call this immediately after import to disable default full filesystem access.
  *
  * @example
  * import { _clearPreopens } from '@bytecodealliance/preview2-shim/filesystem';
- * _clearPreopens(); // Now guest has no filesystem access by default
+ * _clearPreopens();
  */
 export function _clearPreopens() {
     preopenEntries = [];

package/dist/nodejs/http.d.ts

@@ -1,31 +1,7 @@
 import type { types as TypesNamespace } from "../../types/http.js";
-import { OutputStream, Pollable } from "../../types/interfaces/wasi-io-streams.js";
+import { Pollable } from "../../types/interfaces/wasi-io-streams.js";
 declare const symbolDispose: symbol;
 export declare const _forbiddenHeaders: Set<string>;
-declare class OutgoingRequest implements TypesNamespace.OutgoingRequest {
-    #private;
-    [symbolDispose]: () => void;
-    constructor(headers: any);
-    body(): OutgoingBody;
-    method(): TypesNamespace.Method;
-    setMethod(method: any): void;
-    pathWithQuery(): string | undefined;
-    setPathWithQuery(pathWithQuery: any): void;
-    scheme(): TypesNamespace.Scheme | undefined;
-    setScheme(scheme: any): void;
-    authority(): string | undefined;
-    setAuthority(authority: any): void;
-    headers(): Fields;
-    static _handle(request: any, options: any): FutureIncomingResponse;
-}
-declare class OutgoingBody implements TypesNamespace.OutgoingBody {
-    #private;
-    [symbolDispose]: () => void;
-    write(): OutputStream;
-    static finish(body: OutgoingBody, trailers: Fields | undefined): void;
-    static _outputStreamId(outgoingBody: any): any;
-    static _create(contentLength: any): OutgoingBody;
-}
 declare class FutureIncomingResponse implements TypesNamespace.FutureIncomingResponse {
     #private;
     [symbolDispose]: () => void;
@@ -33,42 +9,15 @@ declare class FutureIncomingResponse implements TypesNamespace.FutureIncomingRes
     get(): any;
     static _create(method: any, scheme: any, authority: any, pathWithQuery: any, headers: any, body: any, connectTimeout: any, betweenBytesTimeout: any, firstByteTimeout: any): FutureIncomingResponse;
 }
-declare class Fields {
-    #private;
-    /**
-     * @param {[string, Uint8Array[][]][]} entries
-     */
-    static fromList(entries: any): Fields;
-    get(name: any): TypesNamespace.FieldValue[];
-    /**
-     * WIT spec (https://github.com/WebAssembly/WASI/blob/91bb44c3c3a9b1e09187db23c85fa844d1fd6b15/proposals/http/wit/types.wit#L215-L223):
-     *
-     * > Set all of the values for a name. Clears any existing values for that
-     * > name, if they have been set.
-     * >
-     * > Fails with `header-error.immutable` if the `fields` are immutable.
-     * >
-     * > Fails with `header-error.invalid-syntax` if the `field-name` or any of
-     * > the `field-value`s are syntactically invalid.
-     *
-     * The existing-branch splice/reuse is an allocation optimization — values are cleared, not retained.
-     */
-    set(name: any, values: any): void;
-    has(name: any): boolean;
-    delete(name: any): void;
-    append(name: any, value: any): void;
-    entries(): [string, TypesNamespace.FieldValue][];
-    clone(): Fields;
-    static _lock(fields: any): any;
-    static _fromEntriesChecked(entries: any): Fields;
-}
+/** Deny outbound HTTP for the process-global HTTP namespace. */
+export declare function _denyHttp(): void;
 export declare const outgoingHandler: {
     /**
      * @param {OutgoingRequest} request
      * @param {RequestOptions | undefined} options
      * @returns {FutureIncomingResponse}
      */
-    handle: typeof OutgoingRequest._handle;
+    handle(request: any, options: any): FutureIncomingResponse;
 };
 export declare const types: typeof TypesNamespace;
 export declare class HTTPServer {

package/dist/nodejs/http.js

@@ -546,13 +546,23 @@ delete Fields._lock;
 const fieldsFromEntriesChecked = Fields._fromEntriesChecked;
 // @ts-expect-error - Deleting static method
 delete Fields._fromEntriesChecked;
+let httpEnabled = true;
+/** Deny outbound HTTP for the process-global HTTP namespace. */
+export function _denyHttp() {
+    httpEnabled = false;
+}
 export const outgoingHandler = {
     /**
      * @param {OutgoingRequest} request
      * @param {RequestOptions | undefined} options
      * @returns {FutureIncomingResponse}
      */
-    handle: outgoingRequestHandle,
+    handle(request, options) {
+        if (!httpEnabled) {
+            throw "access-denied";
+        }
+        return outgoingRequestHandle(request, options);
+    },
 };
 function httpErrorCode(err) {
     if (err.payload) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bytecodealliance/preview2-shim",
-  "version": "0.26.0",
+  "version": "0.27.0",
   "description": "WASI Preview2 shim for JS environments",
   "homepage": "https://github.com/bytecodealliance/jco#readme",
   "bugs": {
@@ -68,7 +68,7 @@
     "@bytecodealliance/jco": "1.25.2",
     "@types/node": "^24.12.4",
     "mime": "^4.0.7",
-    "puppeteer": "^25.1.0",
+    "puppeteer": "^25.12.0",
     "rolldown": "^1.2.4",
     "typescript": "7.0.2",
     "vitest": "^4.1.11"