containerd / containerd/runwasi

Code Scanning Alert (high): Wasm binary files are directly stored in source code repo

Open
#912 0 comments 0 reactions 1 assignee Claimed by @Mossaka View on GitHub
Dominant language
Rust
Stars
1.3k
Forks
131
PR merge metrics
No merged PRs in 30d

Description

There are several high-sev alerts related to Wasm binary files being stored directly in the source code repository.

E.g. https://github.com/containerd/runwasi/security/code-scanning/1, https://github.com/containerd/runwasi/security/code-scanning/2, https://github.com/containerd/runwasi/security/code-scanning/3, and https://github.com/containerd/runwasi/security/code-scanning/4

How to Remedy This Issue:

1. Implement a build-from-source approach. For example, for `hello_wasi_http_csharp.wasm` file, we can store only the C# source code and have a script to compile it to the Wasm file for testing.
2. Consider adding .wasm files to `.gitignore` to prevent accidental commits in the future

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.