Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add a minimal Security and Privacy Considerations section #1818

Merged
merged 3 commits into from
Oct 3, 2024
Merged

Add a minimal Security and Privacy Considerations section #1818

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8e136de
Add a minimal Security and Privacy Considerations section
dschuff Oct 2, 2024
c5ace67
Merge branch 'main' into secpriv-web2
dschuff Oct 2, 2024
f99fd43
Apply review suggestsions
dschuff Oct 2, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions document/web-api/index.bs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -305,6 +305,18 @@ application/wasm
</dl></dd>


<h2 id="security-considerations">Security and Privacy Considerations</h2>

<p><em>This section is non-normative.</em></p>
WebAssembly provides no access to the surrounding environment other than via the JavaScript API described in the [[WASMJS|JS API]] specification.
Therefore, WebAssembly cannot collect or expose any information (personal, sensitive or otherwise) to Web sites or other parties beyond what can be collected, exposed or processed with JavaScript.
WebAssembly memory has the same lifetime as the objects in the surrounding JavaScript environment and is not persisted or serialized (other than by copying it out to JavaScript and using existing serialization APIs).
No access is provided to the underlying platform or hardware, or to other devices, or to the user agent’s native UI.

WebAssembly is an additional program execution mechanism, and can be executed wherever JavaScript can be executed.
Therefore the threat model is essentially the same as for JavaScript code, and has similar considerations for delivery (e.g. WebAssembly code should be protected in transit from active and passive network attackers)
and policy (e.g. some loading mechanisms or execution are restricted via mechanisms such as the same-origin policy or Content Security Policy).

<h2 id="change-history">Change History</h2>

<p><em>This section is non-normative.</em></p>
Expand Down
Loading