Currently Store::epoch_deadline_callback provides the ability to run a custom embedder-defined hook whenever an epoch change is detected by guest code executing. This callback is yielded a StoreContextMut<T> which enables full access to pretty much everything in the store, including executing/mutating wasm. This is, as we've now realized, too poweful of a capability. Stemming from discussions on #11869 it is a semantic specification violation for any guest-visible state in the store to get mutated between wasm instructions. This means that if the embedder were to call into wasm, mutate a global, mutate memory, mutate tables, etc, this is all in violation of wasm semantics. This mutation has additionally been a contributing factor in security vulnerabilities in the past.
The current thinking is that we may want to replace the StoreContextMut argument with a custom type that gives access to &mut T and gives access to StoreContext (implements AsContext). This would continue to allow the embedder to inspect/mutate their own state, but would disallow embedders from mutating anything within the store.
Currently
Store::epoch_deadline_callbackprovides the ability to run a custom embedder-defined hook whenever an epoch change is detected by guest code executing. This callback is yielded aStoreContextMut<T>which enables full access to pretty much everything in the store, including executing/mutating wasm. This is, as we've now realized, too poweful of a capability. Stemming from discussions on #11869 it is a semantic specification violation for any guest-visible state in the store to get mutated between wasm instructions. This means that if the embedder were to call into wasm, mutate a global, mutate memory, mutate tables, etc, this is all in violation of wasm semantics. This mutation has additionally been a contributing factor in security vulnerabilities in the past.The current thinking is that we may want to replace the
StoreContextMutargument with a custom type that gives access to&mut Tand gives access toStoreContext(implementsAsContext). This would continue to allow the embedder to inspect/mutate their own state, but would disallow embedders from mutating anything within the store.