TestFilesystemIsolation verifies that WASM policies CANNOT access the host filesystem IMPORTANT SECURITY VERIFICATION: This test confirms that the Extism runtime provides filesystem isolation by default when EnableWasi is true. Even without explicit AllowedPaths configuration, WASM policies are san
(t *testing.T)
| 151 | // The test policy attempts to stat() these paths and reports violations if successful. |
| 152 | // A passing test (no violations) means filesystem isolation is working correctly. |
| 153 | func TestFilesystemIsolation(t *testing.T) { |
| 154 | // Load the compiled test WASM policy that attempts filesystem access |
| 155 | wasmPath := filepath.Join("testdata", "filesystem_test_policy.wasm") |
| 156 | wasmBytes, err := os.ReadFile(wasmPath) |
| 157 | require.NoError(t, err, "Failed to load test WASM policy - run 'make build-test-wasm' first") |
| 158 | |
| 159 | eng := NewEngine() |
| 160 | ctx := context.Background() |
| 161 | |
| 162 | policy := &engine.Policy{ |
| 163 | Name: "filesystem-security-test", |
| 164 | Source: wasmBytes, |
| 165 | } |
| 166 | input := []byte(`{}`) // Empty input, policy will try filesystem access |
| 167 | |
| 168 | t.Run("verify filesystem isolation is working", func(t *testing.T) { |
| 169 | result, err := eng.Verify(ctx, policy, input, nil) |
| 170 | require.NoError(t, err, "Policy execution should not error") |
| 171 | require.NotNil(t, result) |
| 172 | |
| 173 | // Check if the policy reported any security violations |
| 174 | // If there are violations, it means the policy was able to access host files (BAD) |
| 175 | // If there are no violations, it means filesystem access was blocked (GOOD) |
| 176 | if len(result.Violations) > 0 { |
| 177 | t.Logf("SECURITY WARNING: Policy accessed host filesystem!") |
| 178 | for _, violation := range result.Violations { |
| 179 | t.Logf(" - %s", violation.Violation) |
| 180 | } |
| 181 | require.FailNow(t, "SECURITY ISSUE: WASM policy was able to access host filesystem without isolation") |
| 182 | } else { |
| 183 | t.Log("Filesystem isolation is working correctly - policy was blocked from accessing host files") |
| 184 | t.Log("Verified: /etc/passwd, /etc/hosts, current directory, and root directory are all inaccessible") |
| 185 | } |
| 186 | }) |
| 187 | } |