containerd / containerd/runwasi
Code Scanning Alert (high): Wasm binary files are directly stored in source code repo
- Dominant language
- Rust
- Stars
- 1.3k
- Forks
- 131
- PR merge metrics
- No merged PRs in 30d
Description
There are several high-sev alerts related to Wasm binary files being stored directly in the source code repository.
E.g. https://github.com/containerd/runwasi/security/code-scanning/1, https://github.com/containerd/runwasi/security/code-scanning/2, https://github.com/containerd/runwasi/security/code-scanning/3, and https://github.com/containerd/runwasi/security/code-scanning/4
How to Remedy This Issue:
1. Implement a build-from-source approach. For example, for `hello_wasi_http_csharp.wasm` file, we can store only the C# source code and have a script to compile it to the Wasm file for testing.
2. Consider adding .wasm files to `.gitignore` to prevent accidental commits in the future
Contributor guide
Assessment
This issue has not been assessed yet.