Audit Rhai engine feature flags for file system access

[careck]

Security Review Finding — HIGH Priority

Source: Krillnotes Security Review v1.0.1 (April 2026)
Location: krillnotes-core/src/core/scripting/engine.rs

Description

Rhai scripts can call registered native functions (get_note, get_children, create_child, set_field, set_title, markdown, etc.). However, there is no explicit restriction on Rhai's built-in file I/O capabilities if enabled. The Engine::new() default may allow read_file/write_file depending on Rhai feature flags.

Impact

If Rhai's file I/O packages are enabled (even unintentionally), user-authored scripts could read/write arbitrary files on the host filesystem. This is a sandbox escape risk.

Recommendation

1. Audit Rhai feature flags in Cargo.toml — ensure no_std or disable file system packages
2. Register only explicitly allowlisted functions
3. Verify that Engine::new() does not include file I/O packages by default with current feature flags
4. Consider using Engine::new_raw() + explicit package registration for defense in depth

Acceptance Criteria

• Rhai feature flags audited and documented
• File I/O functions confirmed disabled or explicitly blocked
• Test added that verifies read_file/write_file are not callable from scripts