From 9c503a32fa5e6ae52187be47fa4d38d6526d56ee Mon Sep 17 00:00:00 2001 From: Alex Crichton Date: Wed, 14 Oct 2026 12:40:34 -0700 Subject: [PATCH] Update paths in `http-request.rs` test This commit updates the `http-request.rs` test to change its assertion that some preexisting paths that were asserted to work are actually asserted to fail. This is being made as a part of the response to GHSA-5qpp-g3j2-8frx, a vulnerability in Wasmtime, where the belief is that this test was erroneous in accepting these paths previously and they should instead be disallowed. --- expectations/jco/linux.toml | 4 ++ expectations/jco/macos.toml | 4 ++ expectations/jco/windows.toml | 4 ++ .../wasm32-wasip3/src/bin/http-request.rs | 13 +++---- toolchains/runtimes/releases.bzl | 38 +++++++++---------- toolchains/runtimes/runtimes.bzl | 2 +- 6 files changed, 38 insertions(+), 27 deletions(-) diff --git a/expectations/jco/linux.toml b/expectations/jco/linux.toml index a52d61785..0e1da1882 100644 --- a/expectations/jco/linux.toml +++ b/expectations/jco/linux.toml @@ -2,3 +2,7 @@ version = 1 [[suite]] name = "WASI Rust tests [wasm32-wasip3]" + +[[suite.test]] +name = "http-request" +expected = "fail" diff --git a/expectations/jco/macos.toml b/expectations/jco/macos.toml index a52d61785..0e1da1882 100644 --- a/expectations/jco/macos.toml +++ b/expectations/jco/macos.toml @@ -2,3 +2,7 @@ version = 1 [[suite]] name = "WASI Rust tests [wasm32-wasip3]" + +[[suite.test]] +name = "http-request" +expected = "fail" diff --git a/expectations/jco/windows.toml b/expectations/jco/windows.toml index a52d61785..0e1da1882 100644 --- a/expectations/jco/windows.toml +++ b/expectations/jco/windows.toml @@ -2,3 +2,7 @@ version = 1 [[suite]] name = "WASI Rust tests [wasm32-wasip3]" + +[[suite.test]] +name = "http-request" +expected = "fail" diff --git a/tests/rust/wasm32-wasip3/src/bin/http-request.rs b/tests/rust/wasm32-wasip3/src/bin/http-request.rs index 484102d1b..b74986d07 100644 --- a/tests/rust/wasm32-wasip3/src/bin/http-request.rs +++ b/tests/rust/wasm32-wasip3/src/bin/http-request.rs @@ -138,19 +138,18 @@ fn is_valid_path_char(ch: char) -> bool { fn test_path_with_query(request: &Request) { request.set_scheme(Some(&Scheme::Http)).unwrap(); request.set_method(&Method::Get).unwrap(); - for abs in ["/", "/a/b/c", "/a/../../bar", "/?foo"] { + for abs in ["/", "/a/b/c", "/a/../../bar", "/?foo", "?foo", "//hi"] { request .set_path_with_query(Some(&abs.to_string())) .expect(abs); assert_eq!(request.get_path_with_query(), Some(abs.to_string())); } - // https://github.com/WebAssembly/wasi-http/issues/178#issuecomment-3359974132 - for rel in ["a/b/c", "../..", "?foo"] { - request - .set_path_with_query(Some(&rel.to_string())) - .expect(rel); - assert_eq!(request.get_path_with_query(), Some(rel.to_string())); + for rel in ["a/b/c", "../..", "http://example.com"] { + assert!( + request.set_path_with_query(Some(&rel.to_string())).is_err(), + "expected {rel} to fail", + ); } request.set_path_with_query(Some(&"".to_string())).unwrap(); diff --git a/toolchains/runtimes/releases.bzl b/toolchains/runtimes/releases.bzl index 92104184d..af6069ed3 100644 --- a/toolchains/runtimes/releases.bzl +++ b/toolchains/runtimes/releases.bzl @@ -1,59 +1,59 @@ """Release metadata for WASI runtime binaries.""" WASMTIME_RELEASES = { - "49.0.1": { + "49.0.3": { "aarch64-linux": { "url": ( "https://github.com/bytecodealliance/wasmtime/releases/" + - "download/v49.0.1/wasmtime-v49.0.1-aarch64-linux.tar.xz" + "download/v49.0.3/wasmtime-v49.0.3-aarch64-linux.tar.xz" ), - "shasum": "7607529c40fed69c0f5d2a6fafa8c560b9e3c18ded31d8f1b13098afe49b7480", - "prefix": "wasmtime-v49.0.1-aarch64-linux", + "shasum": "880fcb026da88ad7fc1713d572b0d03d139758b7da96cd3cb8c9cbf847a521df", + "prefix": "wasmtime-v49.0.3-aarch64-linux", "binary": "wasmtime", }, "aarch64-macos": { "url": ( "https://github.com/bytecodealliance/wasmtime/releases/" + - "download/v49.0.1/wasmtime-v49.0.1-aarch64-macos.tar.xz" + "download/v49.0.3/wasmtime-v49.0.3-aarch64-macos.tar.xz" ), - "shasum": "93dde14d4efb20046e5af75517ac6a7f2246f6c2370fecff8f68839d4a9028f7", - "prefix": "wasmtime-v49.0.1-aarch64-macos", + "shasum": "d7708ba1cc2da171db2c8273d8602f3e0684935dc7cab40148cdcca1da83c0f8", + "prefix": "wasmtime-v49.0.3-aarch64-macos", "binary": "wasmtime", }, "aarch64-windows": { "url": ( "https://github.com/bytecodealliance/wasmtime/releases/" + - "download/v49.0.1/wasmtime-v49.0.1-aarch64-windows.zip" + "download/v49.0.3/wasmtime-v49.0.3-aarch64-windows.zip" ), - "shasum": "98c4b6efc086198df195564573904ef0b0bcd435ab15a5469094c953b4b981bc", - "prefix": "wasmtime-v49.0.1-aarch64-windows", + "shasum": "bb1ece3bf1660db13f4a10f87436a79542af29b3acd75c0ff54bd0ffbc8d5b62", + "prefix": "wasmtime-v49.0.3-aarch64-windows", "binary": "wasmtime", }, "x86_64-linux": { "url": ( "https://github.com/bytecodealliance/wasmtime/releases/" + - "download/v49.0.1/wasmtime-v49.0.1-x86_64-linux.tar.xz" + "download/v49.0.3/wasmtime-v49.0.3-x86_64-linux.tar.xz" ), - "shasum": "c71f7e0d30a92e418f0d17db7c6d8f6664c1ad764340a1278678f4209deab534", - "prefix": "wasmtime-v49.0.1-x86_64-linux", + "shasum": "4001225413f208345b980525f31c4080e1873808b38d0ddc7918497340667fbb", + "prefix": "wasmtime-v49.0.3-x86_64-linux", "binary": "wasmtime", }, "x86_64-macos": { "url": ( "https://github.com/bytecodealliance/wasmtime/releases/" + - "download/v49.0.1/wasmtime-v49.0.1-x86_64-macos.tar.xz" + "download/v49.0.3/wasmtime-v49.0.3-x86_64-macos.tar.xz" ), - "shasum": "56355136c4eaba17ef50b0e35e9774e25950333ba007c2a29c45d0906600e827", - "prefix": "wasmtime-v49.0.1-x86_64-macos", + "shasum": "bc131e20ed9cb34083fca1a203b38ec9d9e611e96596a10ab0cc9223cb06cd88", + "prefix": "wasmtime-v49.0.3-x86_64-macos", "binary": "wasmtime", }, "x86_64-windows": { "url": ( "https://github.com/bytecodealliance/wasmtime/releases/" + - "download/v49.0.1/wasmtime-v49.0.1-x86_64-windows.zip" + "download/v49.0.3/wasmtime-v49.0.3-x86_64-windows.zip" ), - "shasum": "db0dd3dd77696fa189b08e256a50ddbe46d10a4d1e6c862d8d268ad0abc8c2c1", - "prefix": "wasmtime-v49.0.1-x86_64-windows", + "shasum": "bee8f02158458a5f360412b232543d4fea379b71b94380b806e7980050596c18", + "prefix": "wasmtime-v49.0.3-x86_64-windows", "binary": "wasmtime", }, }, diff --git a/toolchains/runtimes/runtimes.bzl b/toolchains/runtimes/runtimes.bzl index 07648d60d..e665caf60 100644 --- a/toolchains/runtimes/runtimes.bzl +++ b/toolchains/runtimes/runtimes.bzl @@ -9,7 +9,7 @@ DEFAULT_JCO_VERSION = "1.35.0" DEFAULT_NODE_VERSION = "26.8.2" DEFAULT_WAMR_VERSION = "2.4.5" DEFAULT_WASMEDGE_VERSION = "0.17.1" -DEFAULT_WASMTIME_VERSION = "49.0.1" +DEFAULT_WASMTIME_VERSION = "49.0.3" DEFAULT_WAZERO_VERSION = "1.12.0" def _runtime_platform() -> str: