Run Python code in a WebAssembly sandbox#

1
cd /tmp
2
mkdir wasm
3
cd wasm
4
wget https://github.com/vmware-labs/webassembly-language-runtimes/releases/download/python%2F3.11.1%2B20230118-f23f3f3/python-aio-3.11.1.zip
5
unzip python-aio-3.11.1.zip

1
python3 -m venv venv
2
source venv/bin/activate
3
pip install wasmtime

1
from wasmtime import Config, Engine, Linker, Module, Store, WasiConfig
2
import os
3
import tempfile
4

5

6
class Result:
7
    def __init__(self, result, mem_size, data_len, consumed):
8
        self.result = result
9
        self.mem_size = mem_size
10
        self.data_len = data_len
11
        self.consumed = consumed
12

13
    def __str__(self):
14
        return f"""\
15
result:
16

17
{self.result}
18

19
mem size pages of 64kb: {self.mem_size}
20
data length: {self.data_len}
21
fuel consumed: {self.consumed}
22
"""
23

24

25
def run_python_code(code, fuel=400_000_000):
26
    engine_cfg = Config()
27
    engine_cfg.consume_fuel = True
28
    engine_cfg.cache = True
29

30
    linker = Linker(Engine(engine_cfg))
31
    linker.define_wasi()
32

33
    python_module = Module.from_file(linker.engine, "bin/python-3.11.1.wasm")
34

35
    config = WasiConfig()
36

37
    config.argv = ("python", "-c", code)
38
    config.preopen_dir(".", "/")
39

40
    with tempfile.TemporaryDirectory() as chroot:
41
        out_log = os.path.join(chroot, "out.log")
42
        err_log = os.path.join(chroot, "err.log")
43
        config.stdout_file = out_log
44
        config.stderr_file = err_log
45

46
        store = Store(linker.engine)
47

48
        # Limits how many instructions can be executed:
49
        store.add_fuel(fuel)
50
        store.set_wasi(config)
51
        instance = linker.instantiate(store, python_module)
52

53
        # _start is the default wasi main function
54
        start = instance.exports(store)["_start"]
55

56
        mem = instance.exports(store)["memory"]
57

58
        try:
59
            start(store)
60
        except Exception as e:
61
            print(e)
62
            raise
63

64
        with open(out_log) as f:
65
            result = f.read()
66

67
        return Result(
68
            result, mem.size(store), mem.data_len(store), store.fuel_consumed()
69
        )
70

71

72
if __name__ == "__main__":
73
    for code in (
74
        "print('hello world')",
75
        "for i in range(10000): print('hello world')",
76
        "print('hello world')",
77
        "for i in range(100000): print('hello world')",
78
        "import sqlite3; print(sqlite3.connect(':memory:').execute('select sqlite_version()').fetchone()[0])"
79
    ):
80
        try:
81
            print(code)
82
            print("====")
83
            print(run_python_code(code))
84
        except Exception as e:
85
            print(e)

1
wasmtime % pipenv run python demo.py
2
print('hello world')
3
====
4
result:
5

6
hello world
7

8

9
mem size pages of 64kb: 160
10
data length: 10485760
11
fuel consumed: 230790953
12

13
for i in range(10000): print('hello world')
14
====
15
error while executing at wasm backtrace:
16
    0: 0xb02e6 - <unknown>!<wasm function 1505>
17
    1: 0xb2967 - <unknown>!<wasm function 1536>
18
    2: 0x1b9221 - <unknown>!<wasm function 3563>
19
    3: 0x1ae61a - <unknown>!<wasm function 3558>
20
    4: 0x49be2a - <unknown>!<wasm function 10123>
21
note: using the `WASMTIME_BACKTRACE_DETAILS=1` environment variable may show more debugging information
22

23
Caused by:
24
    wasm trap: all fuel consumed by WebAssembly
25
error while executing at wasm backtrace:
26
    0: 0xb02e6 - <unknown>!<wasm function 1505>
27
    1: 0xb2967 - <unknown>!<wasm function 1536>
28
    2: 0x1b9221 - <unknown>!<wasm function 3563>
29
    3: 0x1ae61a - <unknown>!<wasm function 3558>
30
    4: 0x49be2a - <unknown>!<wasm function 10123>
31
note: using the `WASMTIME_BACKTRACE_DETAILS=1` environment variable may show more debugging information
32

33
Caused by:
34
    wasm trap: all fuel consumed by WebAssembly
35
print('hello world')
36
====
37
result:
38

39
hello world
40

41

42
mem size pages of 64kb: 160
43
data length: 10485760
44
fuel consumed: 230794521
45

46
for i in range(100000): print('hello world')
47
====
48
error while executing at wasm backtrace:
49
    0: 0x7d7f - <unknown>!<wasm function 72>
50
...
51
   17: 0x1c52e9 - <unknown>!<wasm function 3618>
52
   18: 0x49b7c9 - <unknown>!<wasm function 10123>
53
note: using the `WASMTIME_BACKTRACE_DETAILS=1` environment variable may show more debugging information
54

55
Caused by:
56
    wasm trap: all fuel consumed by WebAssembly
57
error while executing at wasm backtrace:
58
    0: 0x7d7f - <unknown>!<wasm function 72>
59
...
60
   16: 0x1c53c2 - <unknown>!<wasm function 3619>
61
   17: 0x1c52e9 - <unknown>!<wasm function 3618>
62
   18: 0x49b7c9 - <unknown>!<wasm function 10123>
63
note: using the `WASMTIME_BACKTRACE_DETAILS=1` environment variable may show more debugging information
64

65
Caused by:
66
    wasm trap: all fuel consumed by WebAssembly
67
import sqlite3; print(sqlite3.connect(':memory:').execute('select sqlite_version()').fetchone()[0])
68
====
69
result:
70

71
3.39.2
72

73

74
mem size pages of 64kb: 160
75
data length: 10485760
76
fuel consumed: 381954995

1
3.39.2