Ensure valid wasms when publishing app

Signed-off-by: Brian Hardock <[email protected]>

Author: fibonacci1729

Cargo.lock

@@ -30,6 +30,7 @@ tokio = { workspace = true, features = ["fs"] }
 tokio-util = { version = "0.7", features = ["compat"] }
 tracing = { workspace = true }
 walkdir = { workspace = true }
+wasmparser = { workspace = true }
 
 [dev-dependencies]
 wasm-encoder = { workspace = true }

crates/oci/Cargo.toml

@@ -24,6 +24,7 @@ use tokio::fs;
 use walkdir::WalkDir;
 
 use crate::auth::AuthConfig;
+use crate::validate;
 
 // TODO: the media types for application, data and archive layer are not final
 /// Media type for a layer representing a locked Spin application configuration
@@ -149,6 +150,12 @@ impl Client {
         )
         .await?;
 
+        // Ensure that all Spin components specify valid wasm binaries in both the `source`
+        // field and for each dependency.
+        for locked_component in &locked.components {
+            validate::ensure_wasms(locked_component).await?;
+        }
+
         self.push_locked_core(
             locked,
             auth,

crates/oci/src/client.rs

@@ -5,6 +5,7 @@ mod auth;
 pub mod client;
 mod loader;
 pub mod utils;
+mod validate;
 
 pub use client::{Client, ComposeMode};
 pub use loader::OciLoader;

crates/oci/src/lib.rs

@@ -0,0 +1,193 @@
+use anyhow::{bail, Context, Result};
+use spin_common::{ui::quoted_path, url::parse_file_url};
+use spin_locked_app::locked::{LockedComponent, LockedComponentSource};
+
+// Validate that all Spin components specify valid wasm binaries in both the `source`
+// field and for each dependency.
+pub async fn ensure_wasms(component: &LockedComponent) -> Result<()> {
+    // Ensure that the component source is a valid wasm binary.
+    let bytes = read_component_source(&component.source).await?;
+    if !is_wasm_binary(&bytes) {
+        bail!(
+            "Component {} source is not a valid .wasm file",
+            component.id,
+        );
+    }
+
+    // Ensure that each dependency is a valid wasm binary.
+    for (dep_name, dep) in &component.dependencies {
+        let bytes = read_component_source(&dep.source).await?;
+        if !is_wasm_binary(&bytes) {
+            bail!(
+                "dependency {} for component {} is not a valid .wasm file",
+                dep_name,
+                component.id,
+            );
+        }
+    }
+    Ok(())
+}
+
+fn is_wasm_binary(bytes: &[u8]) -> bool {
+    wasmparser::Parser::is_component(bytes) || wasmparser::Parser::is_core_wasm(bytes)
+}
+
+async fn read_component_source(source: &LockedComponentSource) -> Result<Vec<u8>> {
+    let source = source
+        .content
+        .source
+        .as_ref()
+        .context("LockedComponentSource missing source field")?;
+
+    let path = parse_file_url(source)?;
+
+    let bytes: Vec<u8> = tokio::fs::read(&path).await.with_context(|| {
+        format!(
+            "failed to read component source from disk at path {}",
+            quoted_path(&path)
+        )
+    })?;
+    Ok(bytes)
+}
+
+#[cfg(test)]
+mod test {
+    use super::*;
+    use crate::from_json;
+    use spin_locked_app::locked::LockedComponent;
+    use tokio::io::AsyncWriteExt;
+
+    #[tokio::test]
+    async fn ensures_valid_wasm_binaries() {
+        let working_dir = tempfile::tempdir().unwrap();
+        let _ = tokio::fs::create_dir(working_dir.path()).await;
+
+        // valid component source
+        let mut valid_wasm_component_file =
+            tokio::fs::File::create(working_dir.path().join("component.wasm"))
+                .await
+                .expect("should create component file");
+        valid_wasm_component_file
+            .write_all(b"\x00\x61\x73\x6D\x0D\x00\x01\x00")
+            .await
+            .expect("should write file contents");
+
+        // valid core module source
+        let mut valid_wasm_core_module_file =
+            tokio::fs::File::create(working_dir.path().join("module.wasm"))
+                .await
+                .expect("should create core module file");
+        valid_wasm_core_module_file
+            .write_all(b"\x00\x61\x73\x6D\x01\x00\x00\x00")
+            .await
+            .expect("should write file contents");
+
+        // invalid wasm binary
+        let mut invalid_wasm_binary = tokio::fs::File::create(working_dir.path().join("invalid"))
+            .await
+            .expect("should create file");
+        invalid_wasm_binary
+            .write_all(b"not a wasm file")
+            .await
+            .expect("should write file contents");
+
+        #[derive(Clone)]
+        struct TestCase {
+            name: &'static str,
+            locked_component: LockedComponent,
+            valid: bool,
+        }
+
+        let tests: Vec<TestCase> = vec![
+            TestCase {
+                name: "Valid Spin component source field with component",
+                locked_component: from_json!({
+                    "id": "component",
+                    "source": {
+                        "content_type": "application/wasm",
+                        "source": format!("file://{}", working_dir.path().join("component.wasm").to_str().unwrap()),
+                        "digest": "digest",
+                    }
+                }),
+                valid: true,
+            },
+            TestCase {
+                name: "Valid Spin component source field with core module",
+                locked_component: from_json!({
+                    "id": "component",
+                    "source": {
+                        "content_type": "application/wasm",
+                        "source": format!("file://{}", working_dir.path().join("module.wasm").to_str().unwrap()),
+                        "digest": "digest",
+                    }
+                }),
+                valid: true,
+            },
+            TestCase {
+                name: "Valid Spin component source field with valid wasm dependency",
+                locked_component: from_json!({
+                    "id": "component",
+                    "source": {
+                        "content_type": "application/wasm",
+                        "source": format!("file://{}", working_dir.path().join("component.wasm").to_str().unwrap()),
+                        "digest": "digest",
+                    },
+                    "dependencies": {
+                        "test:comp2": {
+                            "source": {
+                                "content_type": "application/wasm",
+                                "source": format!("file://{}", working_dir.path().join("component.wasm").to_str().unwrap()),
+                                "digest": "digest",
+                            },
+                            "export": null,
+                        }
+                    }
+                }),
+                valid: true,
+            },
+            TestCase {
+                name: "Invalid Spin component source field with invalid wasm binary",
+                locked_component: from_json!({
+                    "id": "component",
+                    "source": {
+                        "content_type": "application/wasm",
+                        "source": format!("file://{}", working_dir.path().join("invalid").to_str().unwrap()),
+                        "digest": "digest",
+                    }
+                }),
+                valid: false,
+            },
+            TestCase {
+                name: "Valid Spin component source field with invalid wasm dependency",
+                locked_component: from_json!({
+                    "id": "component",
+                    "source": {
+                        "content_type": "application/wasm",
+                        "source": format!("file://{}", working_dir.path().join("component.wasm").to_str().unwrap()),
+                        "digest": "digest",
+                    },
+                    "dependencies": {
+                        "test:comp2": {
+                            "source": {
+                                "content_type": "application/wasm",
+                                "source": format!("file://{}", working_dir.path().join("invalid").to_str().unwrap()),
+                                "digest": "digest",
+                            },
+                            "export": null,
+                        }
+                    }
+                }),
+                valid: false,
+            },
+        ];
+
+        for tc in tests {
+            let result = ensure_wasms(&tc.locked_component).await;
+            if tc.valid {
+                assert!(result.is_ok(), "Test failed: {}", tc.name);
+            } else {
+                assert!(result.is_err(), "Test should have failed: {}", tc.name);
+            }
+        }
+    }
+}