Cryptographic check-summing not available for WebAssembly.instantiateStreaming()

[haukehoffmann]

Dear Emscripten Community,

you did such a grat job with designing and implementing emscripten.

I would like to seed to idea of a security improvement, that comes in handy when traffic is transferred through an less trusted environment such as CDN/DDoS protection services.

HTML provides with the script.integrity tag the option to specify a cryptographic checksum that may be enforced; this may be used to protect the emitted js file but not the wasm binary.

However when the emitted JS codes starts WebAssembly.instantiateStreaming(), there is no cryptographic verification of the wasm's checksum possible.

It has been mentioned that the streaming is the most efficient way, so it would be great to have an option to have an option for the integrity, possibly as a 4th argument.

Alternative, until in the standards, I would suggest to have a compiler flag, to change the compilation as follows:

1. Use the fetch API to load the wasm binary.
2. Perform an SHA256-checksum on the binary
3. Throw an exception if the checksum in the emitted javascript doesn't matches the wasm binary; otherwise pass the fetched result into WebAssembly.instantiate()

[sbc100]

I don't know enough about the script.integrity thing to know if there would be some way to add the same thing to WebAssembly.* JS API, but your are right that is really question for the standard folks, not really something emscripten itself can add.

In terms of implementing version of that using fetch + SHA256 that sounds like something can could be done already without changing emscripten using the existing instantiateWasm and/or wasmBinary hooks on the Module object. If you are able to get that working feel free to share it here so other can take advantage of it. We could even include it somehow as an example / test perhaps? But hopefully we can avoid extending the emscripten core behaviours here.