Harden Wasm runtime resource boundaries

Author: eldryoth

CHANGELOG.md

@@ -44,6 +44,9 @@ behavior when the change improves security or project direction.
 - Make directory-listing timestamp formatting checked and preserve the
   `SafeRelativePath` invariant through validated incremental components,
   preventing panic-abort and latent traversal paths in static serving.
+- Add crate-level Wasm resource ceilings, checked execution deadlines,
+  semaphore-capacity validation, fallible compile-worker creation, and
+  before/after deadline checks for the finite non-blocking host-call boundary.
 
 ## 1.7.7 - 2026-07-10
 

crates/fluxheim-config/src/config_tests_wasm.rs

@@ -288,6 +288,44 @@ fn wasm_registry_builds_loader_manifest_with_plugin_overrides() {
     fluxheim_wasm::validate_plugin_manifest(manifests[0].clone(), false).unwrap();
 }
 
+#[cfg(feature = "wasm")]
+#[test]
+fn wasm_registry_rejects_limits_above_runtime_hard_ceiling() {
+    let mut cases = Vec::new();
+
+    let mut config = base_wasm_config("");
+    config.wasm.default_limits.max_module_bytes = super::ByteSize::from_bytes(16 * 1024 * 1024 + 1);
+    cases.push(("max_module_bytes", config));
+
+    let mut config = base_wasm_config("");
+    config.wasm.default_limits.max_memory_bytes =
+        super::ByteSize::from_bytes(256 * 1024 * 1024 + 1);
+    cases.push(("max_memory_bytes", config));
+
+    let mut config = base_wasm_config("");
+    config.wasm.default_limits.max_table_elements = 100_001;
+    cases.push(("max_table_elements", config));
+
+    let mut config = base_wasm_config("");
+    config.wasm.default_limits.fuel = 100_000_001;
+    cases.push(("fuel", config));
+
+    let mut config = base_wasm_config("");
+    config.wasm.default_limits.timeout_ms = 5_001;
+    cases.push(("timeout_ms", config));
+
+    let mut config = base_wasm_config("");
+    config.wasm.default_limits.compile_timeout_ms = 10_001;
+    cases.push(("compile_timeout_ms", config));
+
+    for (expected_field, config) in cases {
+        assert!(matches!(
+            config.validate(),
+            Err(ConfigError::InvalidWasmPolicy { field, .. }) if field == expected_field
+        ));
+    }
+}
+
 #[cfg(all(feature = "wasm", not(feature = "wasm-proxy-abi")))]
 #[test]
 fn wasm_proxy_preview_namespace_requires_feature() {

crates/fluxheim-config/src/config_wasm.rs

@@ -16,6 +16,24 @@ pub const MAX_WASM_MAX_CONCURRENT_EXECUTIONS: u32 = 256;
 pub const MAX_WASM_MAX_TOTAL_PREVIEW_CONCURRENT_EXECUTIONS: u32 = 32;
 pub const MAX_WASM_QUEUE_LIMIT: u32 = 256;
 pub const MAX_WASM_ATTACHMENT_PRIORITY: u32 = 1_000_000;
+pub const MAX_WASM_MODULE_BYTES: u64 = 16 * 1024 * 1024;
+pub const MAX_WASM_MEMORY_BYTES: u64 = 256 * 1024 * 1024;
+pub const MAX_WASM_TABLE_ELEMENTS: u32 = 100_000;
+pub const MAX_WASM_FUEL: u64 = 100_000_000;
+pub const MAX_WASM_TIMEOUT_MS: u64 = 5_000;
+pub const MAX_WASM_COMPILE_TIMEOUT_MS: u64 = 10_000;
+
+#[cfg(feature = "wasm")]
+const _: () = {
+    assert!(MAX_WASM_MODULE_BYTES == fluxheim_wasm::HARD_MAX_MODULE_BYTES);
+    assert!(MAX_WASM_MEMORY_BYTES as usize == fluxheim_wasm::HARD_MAX_MEMORY_BYTES);
+    assert!(MAX_WASM_TABLE_ELEMENTS as usize == fluxheim_wasm::HARD_MAX_TABLE_ELEMENTS);
+    assert!(MAX_WASM_FUEL == fluxheim_wasm::HARD_MAX_FUEL);
+    assert!(MAX_WASM_TIMEOUT_MS == fluxheim_wasm::HARD_MAX_TIMEOUT.as_millis() as u64);
+    assert!(
+        MAX_WASM_COMPILE_TIMEOUT_MS == fluxheim_wasm::HARD_MAX_COMPILE_TIMEOUT.as_millis() as u64
+    );
+};
 
 const DEFAULT_WASM_MAX_MODULE_BYTES: u64 = 1_048_576;
 const DEFAULT_WASM_MAX_MEMORY_BYTES: u64 = 16 * 1024 * 1024;
@@ -633,46 +651,50 @@ impl Default for WasmSandboxLimitsConfig {
 
 impl WasmSandboxLimitsConfig {
     fn validate(&self, field: &'static str) -> Result<(), ConfigError> {
-        if self.max_module_bytes.as_u64() == 0 {
+        if self.max_module_bytes.as_u64() == 0
+            || self.max_module_bytes.as_u64() > MAX_WASM_MODULE_BYTES
+        {
             return Err(ConfigError::InvalidWasmPolicy {
                 scope: field.to_owned(),
                 field: "max_module_bytes",
-                reason: "must be greater than zero",
+                reason: "must be between 1 byte and 16 MiB",
             });
         }
-        if self.max_memory_bytes.as_u64() == 0 {
+        if self.max_memory_bytes.as_u64() == 0
+            || self.max_memory_bytes.as_u64() > MAX_WASM_MEMORY_BYTES
+        {
             return Err(ConfigError::InvalidWasmPolicy {
                 scope: field.to_owned(),
                 field: "max_memory_bytes",
-                reason: "must be greater than zero",
+                reason: "must be between 1 byte and 256 MiB",
             });
         }
-        if self.max_table_elements == 0 {
+        if self.max_table_elements == 0 || self.max_table_elements > MAX_WASM_TABLE_ELEMENTS {
             return Err(ConfigError::InvalidWasmPolicy {
                 scope: field.to_owned(),
                 field: "max_table_elements",
-                reason: "must be greater than zero",
+                reason: "must be between 1 and 100000",
             });
         }
-        if self.fuel == 0 {
+        if self.fuel == 0 || self.fuel > MAX_WASM_FUEL {
             return Err(ConfigError::InvalidWasmPolicy {
                 scope: field.to_owned(),
                 field: "fuel",
-                reason: "must be greater than zero",
+                reason: "must be between 1 and 100000000",
             });
         }
-        if self.timeout_ms == 0 {
+        if self.timeout_ms == 0 || self.timeout_ms > MAX_WASM_TIMEOUT_MS {
             return Err(ConfigError::InvalidWasmPolicy {
                 scope: field.to_owned(),
                 field: "timeout_ms",
-                reason: "must be greater than zero",
+                reason: "must be between 1 and 5000",
             });
         }
-        if self.compile_timeout_ms == 0 {
+        if self.compile_timeout_ms == 0 || self.compile_timeout_ms > MAX_WASM_COMPILE_TIMEOUT_MS {
             return Err(ConfigError::InvalidWasmPolicy {
                 scope: field.to_owned(),
                 field: "compile_timeout_ms",
-                reason: "must be greater than zero",
+                reason: "must be between 1 and 10000",
             });
         }
         Ok(())

crates/fluxheim-wasm/src/lib.rs

@@ -34,6 +34,12 @@ pub const DEFAULT_MAX_TABLE_ELEMENTS: usize = 10_000;
 pub const DEFAULT_FUEL: u64 = 5_000_000;
 pub const DEFAULT_TIMEOUT: Duration = Duration::from_millis(50);
 pub const DEFAULT_COMPILE_TIMEOUT: Duration = Duration::from_millis(500);
+pub const HARD_MAX_MODULE_BYTES: u64 = 16 * 1024 * 1024;
+pub const HARD_MAX_MEMORY_BYTES: usize = 256 * 1024 * 1024;
+pub const HARD_MAX_TABLE_ELEMENTS: usize = 100_000;
+pub const HARD_MAX_FUEL: u64 = 100_000_000;
+pub const HARD_MAX_TIMEOUT: Duration = Duration::from_secs(5);
+pub const HARD_MAX_COMPILE_TIMEOUT: Duration = Duration::from_secs(10);
 
 #[derive(Debug, Clone, Copy, Eq, PartialEq)]
 pub struct WasmSandboxLimits {
@@ -60,40 +66,40 @@ impl Default for WasmSandboxLimits {
 
 impl WasmSandboxLimits {
     pub fn validate(self) -> Result<Self, WasmPluginError> {
-        if self.max_module_bytes == 0 {
+        if self.max_module_bytes == 0 || self.max_module_bytes > HARD_MAX_MODULE_BYTES {
             return Err(WasmPluginError::InvalidLimit {
                 field: "max_module_bytes",
-                reason: "must be greater than zero",
+                reason: "must be between 1 byte and 16 MiB",
             });
         }
-        if self.max_memory_bytes == 0 {
+        if self.max_memory_bytes == 0 || self.max_memory_bytes > HARD_MAX_MEMORY_BYTES {
             return Err(WasmPluginError::InvalidLimit {
                 field: "max_memory_bytes",
-                reason: "must be greater than zero",
+                reason: "must be between 1 byte and 256 MiB",
             });
         }
-        if self.max_table_elements == 0 {
+        if self.max_table_elements == 0 || self.max_table_elements > HARD_MAX_TABLE_ELEMENTS {
             return Err(WasmPluginError::InvalidLimit {
                 field: "max_table_elements",
-                reason: "must be greater than zero",
+                reason: "must be between 1 and 100000",
             });
         }
-        if self.fuel == 0 {
+        if self.fuel == 0 || self.fuel > HARD_MAX_FUEL {
             return Err(WasmPluginError::InvalidLimit {
                 field: "fuel",
-                reason: "must be greater than zero",
+                reason: "must be between 1 and 100000000",
             });
         }
-        if self.timeout.is_zero() {
+        if self.timeout.is_zero() || self.timeout > HARD_MAX_TIMEOUT {
             return Err(WasmPluginError::InvalidLimit {
                 field: "timeout",
-                reason: "must be greater than zero",
+                reason: "must be between 1ns and 5s",
             });
         }
-        if self.compile_timeout.is_zero() {
+        if self.compile_timeout.is_zero() || self.compile_timeout > HARD_MAX_COMPILE_TIMEOUT {
             return Err(WasmPluginError::InvalidLimit {
                 field: "compile_timeout",
-                reason: "must be greater than zero",
+                reason: "must be between 1ns and 10s",
             });
         }
         Ok(self)
@@ -121,4 +127,78 @@ mod tests {
             }
         ));
     }
+
+    #[test]
+    fn sandbox_limits_reject_values_above_hard_ceiling() {
+        let cases = [
+            (
+                "max_module_bytes",
+                WasmSandboxLimits {
+                    max_module_bytes: HARD_MAX_MODULE_BYTES + 1,
+                    ..WasmSandboxLimits::default()
+                },
+            ),
+            (
+                "max_memory_bytes",
+                WasmSandboxLimits {
+                    max_memory_bytes: HARD_MAX_MEMORY_BYTES + 1,
+                    ..WasmSandboxLimits::default()
+                },
+            ),
+            (
+                "max_table_elements",
+                WasmSandboxLimits {
+                    max_table_elements: HARD_MAX_TABLE_ELEMENTS + 1,
+                    ..WasmSandboxLimits::default()
+                },
+            ),
+            (
+                "fuel",
+                WasmSandboxLimits {
+                    fuel: HARD_MAX_FUEL + 1,
+                    ..WasmSandboxLimits::default()
+                },
+            ),
+            (
+                "timeout",
+                WasmSandboxLimits {
+                    timeout: HARD_MAX_TIMEOUT + Duration::from_nanos(1),
+                    ..WasmSandboxLimits::default()
+                },
+            ),
+            (
+                "compile_timeout",
+                WasmSandboxLimits {
+                    compile_timeout: HARD_MAX_COMPILE_TIMEOUT + Duration::from_nanos(1),
+                    ..WasmSandboxLimits::default()
+                },
+            ),
+        ];
+
+        for (field, limits) in cases {
+            assert!(matches!(
+                limits.validate(),
+                Err(WasmPluginError::InvalidLimit {
+                    field: invalid,
+                    ..
+                }) if invalid == field
+            ));
+        }
+    }
+
+    #[test]
+    fn sandbox_limits_accept_values_at_hard_ceiling() {
+        assert!(
+            WasmSandboxLimits {
+                max_module_bytes: HARD_MAX_MODULE_BYTES,
+                max_memory_bytes: HARD_MAX_MEMORY_BYTES,
+                max_table_elements: HARD_MAX_TABLE_ELEMENTS,
+                fuel: HARD_MAX_FUEL,
+                timeout: HARD_MAX_TIMEOUT,
+                compile_timeout: HARD_MAX_COMPILE_TIMEOUT,
+            }
+            .validate()
+            .is_ok()
+        );
+    }
 }