feat: add validate feature

Signed-off-by: Henry <mail@henrygressmann.de>

Author: explodingcamera

CHANGELOG.md

@@ -11,6 +11,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Added support for the WebAssembly function-references proposal
 - Added `WasmValue::ty` and `WasmValue::matches_type`
+- Added a `validate` feature to `tinywasm` and `tinywasm-parser` (enabled by default) to optionally skip wasmparser validation for faster parsing of trusted modules.
 
 ### Changed
 

README.md

@@ -44,10 +44,11 @@ See the [examples](./examples) directory and [documentation](https://docs.rs/tin
 - **`std`:** Enables `std` and parsing from files and streams. Enabled by default.
 - **`log`:** Enables integration with the `log` crate. Enabled by default.
 - **`parser`:** Enables `tinywasm-parser` and top-level parse helpers. Enabled by default.
+- **`validate`:** Enables WebAssembly validation while parsing. Enabled by default and configurable through `ParserOptions`.
 - **`archive`:** Enables serialization and deserialization of the internal `twasm` format. Enabled by default.
 - **`canonicalize-nans`:** Canonicalizes NaN values. Enabled by default.
 - **`debug`:** Derives `Debug` for runtime types. Enabled by default.
-- **`parallel-parser`:** Parallelizes function parsing and validation when `std` is enabled. Enabled by default.
+- **`parallel-parser`:** Parallelizes function parsing when `std` is enabled. Enabled by default.
 - **`guest-debug`:** Exposes module-internal by-index inspection APIs (`*_by_index`).
 - **`simd-x86`:** Enables x86-specific SIMD intrinsics and uses `unsafe` internally.
 
@@ -65,7 +66,7 @@ TinyWasm also has its own internal bytecode format, `twasm`. WebAssembly modules
 
 ## Safety
 
-TinyWasm only uses safe Rust by default. The optional `simd-x86` feature enables x86-specific SIMD intrinsics and uses `unsafe` internally. WebAssembly input is validated by default and runs inside a sandbox: untrusted Wasm should not be able to access host memory, escape the sandbox, or cause undefined behavior in the runtime. Validation should only be disabled for trusted input.
+TinyWasm only uses safe Rust by default. The optional `simd-x86` feature enables x86-specific SIMD intrinsics and uses `unsafe` internally. WebAssembly input is validated by default through the `validate` feature. Disabling validation should not let Wasm access host memory or escape the sandbox, but malformed input may panic or otherwise crash the process, so only disable it for trusted input.
 
 The internal `twasm` bytecode format is not currently validated as an untrusted input format. Malformed `twasm` may panic, but should not compromise memory safety or allow sandbox escape. Only run trusted `twasm` bytecode, or generate it through TinyWasm from Wasm input.
 

crates/cli/Cargo.toml

@@ -37,6 +37,7 @@ tinywasm = { workspace = true, features = [
   "parallel-parser",
   "parser",
   "std",
+  "validate",
 ] }
 wast = { workspace = true, optional = true }
 wat = { workspace = true, optional = true }

crates/parser/Cargo.toml

@@ -13,10 +13,11 @@ categories.workspace = true
 [dependencies]
 log = { workspace = true, optional = true }
 tinywasm-types = { workspace = true }
-wasmparser = { workspace = true, features = ["features", "simd", "validate"] }
+wasmparser = { workspace = true, features = ["simd"] }
 
 [features]
-default = ["log", "parallel", "std"]
+default = ["log", "parallel", "std", "validate"]
 log = ["dep:log"]
 parallel = ["std"]
 std = ["tinywasm-types/std", "wasmparser/std"]
+validate = ["wasmparser/features", "wasmparser/validate"]

crates/parser/README.md

@@ -6,7 +6,8 @@ This crate provides the parser and lowering pipeline that converts WebAssembly b
 
 - `std`: Enables the use of `std` and `std::io` for parsing from files and streams.
 - `log`: Enables logging of the parsing process using the `log` crate.
-- `parallel`: Enables multithreaded parsing and validation when `std` is available.
+- `parallel`: Enables multithreaded function parsing. Requires `std`.
+- `validate`: Enables `wasmparser` validation. Enabled by default and configurable through `ParserOptions`.
 
 ## Usage
 

crates/parser/src/conversion.rs

@@ -1,10 +1,10 @@
-use crate::{Result, module::FunctionCode, visit::process_operators_and_validate};
+use crate::validation::{FuncValidator, FuncValidatorAllocations, ValidatorResources};
+#[cfg(feature = "validate")]
+use crate::visit::process_operators_and_validate;
+use crate::{Result, module::FunctionCode, visit::process_operators};
 use alloc::{boxed::Box, format, string::ToString, vec::Vec};
 use tinywasm_types::*;
-use wasmparser::{
-    CompositeInnerType, FuncValidator, FuncValidatorAllocations, OperatorsReader, OperatorsReaderAllocations,
-    ValidatorResources,
-};
+use wasmparser::{CompositeInnerType, OperatorsReader, OperatorsReaderAllocations};
 
 pub(crate) fn convert_module_element(element: wasmparser::Element<'_>) -> Result<tinywasm_types::Element> {
     let kind = match element.kind {
@@ -116,28 +116,48 @@ pub(crate) fn convert_module_export(export: wasmparser::Export<'_>) -> Result<Ex
     Ok(Export { index: export.index, name: Box::from(export.name), kind })
 }
 
+fn extend_local_types(
+    local_types: &mut Vec<crate::visit::OperandSize>,
+    count: u32,
+    ty: wasmparser::ValType,
+) -> Result<()> {
+    let size = crate::visit::OperandSize::from(ty);
+    let count =
+        usize::try_from(count).map_err(|_| crate::ParseError::Other("local declaration count is too large".into()))?;
+    local_types.reserve(count);
+    local_types.extend(core::iter::repeat_n(size, count));
+    Ok(())
+}
+
 pub(crate) fn convert_module_code(
     func: wasmparser::FunctionBody<'_>,
-    mut validator: Option<FuncValidator<ValidatorResources>>,
+    validator: Option<FuncValidator<ValidatorResources>>,
     reader_allocs: OperatorsReaderAllocations,
     metadata: &crate::visit::ModuleMetadata,
     ty_idx: u32,
 ) -> Result<(FunctionCode, Option<FuncValidatorAllocations>, OperatorsReaderAllocations)> {
     let locals_reader = func.get_locals_reader()?;
-    let pos = locals_reader.original_position();
+    #[cfg(feature = "validate")]
+    let locals_position = locals_reader.original_position();
     let signature = metadata.signature(ty_idx)?.clone();
     let mut local_types = signature.params.clone();
 
-    for (i, local) in locals_reader.into_iter().enumerate() {
+    #[cfg(feature = "validate")]
+    let mut validator = validator;
+
+    #[cfg(feature = "validate")]
+    for (local_index, local) in locals_reader.into_iter().enumerate() {
         let local = local?;
         if let Some(validator) = validator.as_mut() {
-            validator.define_locals(pos + i, local.0, local.1)?;
+            validator.define_locals(locals_position + local_index, local.0, local.1)?;
         }
-        let size = crate::visit::OperandSize::from(local.1);
-        let count = usize::try_from(local.0)
-            .map_err(|_| crate::ParseError::Other("local declaration count is too large".into()))?;
-        local_types.reserve(count);
-        local_types.extend(core::iter::repeat_n(size, count));
+        extend_local_types(&mut local_types, local.0, local.1)?;
+    }
+
+    #[cfg(not(feature = "validate"))]
+    for local in locals_reader {
+        let local = local?;
+        extend_local_types(&mut local_types, local.0, local.1)?;
     }
 
     // maps a local's address to the index in the type's locals array
@@ -154,8 +174,33 @@ pub(crate) fn convert_module_code(
         *count = count.checked_add(1).ok_or_else(|| crate::ParseError::Other(error.into()))?;
     }
 
-    let (body, data, validator_allocs, reader_allocs) =
-        process_operators_and_validate(validator, func, local_types, local_addr_map, metadata, ty_idx, reader_allocs)?;
+    #[cfg(feature = "validate")]
+    let (body, data, validator_allocs, reader_allocs) = match validator {
+        Some(validator) => {
+            let (body, data, validator_allocs, reader_allocs) = process_operators_and_validate(
+                validator,
+                func,
+                local_types,
+                local_addr_map,
+                metadata,
+                ty_idx,
+                reader_allocs,
+            )?;
+            (body, data, Some(validator_allocs), reader_allocs)
+        }
+        None => {
+            let (body, data, reader_allocs) =
+                process_operators(func, local_types, local_addr_map, metadata, ty_idx, reader_allocs)?;
+            (body, data, None, reader_allocs)
+        }
+    };
+    #[cfg(not(feature = "validate"))]
+    let (body, data, validator_allocs, reader_allocs) = {
+        let _ = validator;
+        let (body, data, reader_allocs) =
+            process_operators(func, local_types, local_addr_map, metadata, ty_idx, reader_allocs)?;
+        (body, data, None, reader_allocs)
+    };
     Ok((
         FunctionCode { instructions: body, data, locals: local_counts, uses_local_memory: false },
         validator_allocs,

crates/parser/src/lib.rs

@@ -34,22 +34,29 @@ mod error;
 mod macros;
 mod module;
 mod optimize;
+mod validation;
 mod visit;
 
 #[cfg(parallel_parser)]
 mod parallel;
 
 pub use error::*;
 use module::ModuleReader;
-use wasmparser::{Validator, WasmFeatures};
+use validation::Validator;
+
+#[cfg(feature = "validate")]
+use wasmparser::WasmFeatures;
 
 pub use tinywasm_types::Module;
 
 /// Parser optimization and lowering options.
 #[non_exhaustive]
 #[derive(Debug, Clone)]
 pub struct ParserOptions {
-    /// Whether to validate modules while parsing. Enabled by default.
+    /// Whether to validate modules while parsing. Enabled by default when the
+    /// `validate` feature is enabled.
+    ///
+    /// Requires the `validate` feature to have any effect.
     ///
     /// Disable this only for trusted input. Parsing without validation may produce
     /// a module that violates runtime assumptions.
@@ -73,7 +80,7 @@ pub struct ParserOptions {
 impl Default for ParserOptions {
     fn default() -> Self {
         Self {
-            validation: true,
+            validation: cfg!(feature = "validate"),
             optimize_local_memory_allocation: true,
             optimize_rewrite: true,
             #[cfg(parallel_parser)]
@@ -85,9 +92,12 @@ impl Default for ParserOptions {
 impl ParserOptions {
     /// Enable or disable WebAssembly validation.
     ///
+    /// Requires the `validate` feature to have any effect.
+    ///
     /// Disable this only for trusted input. Parsing without validation may produce
     /// a module that violates runtime assumptions.
     pub const fn with_validation(mut self, enabled: bool) -> Self {
+        assert!(!enabled || cfg!(feature = "validate"), "validation requires the `validate` feature");
         self.validation = enabled;
         self
     }
@@ -157,27 +167,35 @@ impl Parser {
         &self.options
     }
 
-    fn create_validator(_options: ParserOptions) -> Validator {
-        let features = WasmFeatures::CALL_INDIRECT_OVERLONG
-            | WasmFeatures::BULK_MEMORY_OPT
-            | WasmFeatures::RELAXED_SIMD
-            | WasmFeatures::GC_TYPES
-            | WasmFeatures::REFERENCE_TYPES
-            | WasmFeatures::MUTABLE_GLOBAL
-            | WasmFeatures::MULTI_VALUE
-            | WasmFeatures::FLOATS
-            | WasmFeatures::BULK_MEMORY
-            | WasmFeatures::SATURATING_FLOAT_TO_INT
-            | WasmFeatures::SIGN_EXTENSION
-            | WasmFeatures::EXTENDED_CONST
-            | WasmFeatures::FUNCTION_REFERENCES
-            | WasmFeatures::TAIL_CALL
-            | WasmFeatures::MULTI_MEMORY
-            | WasmFeatures::SIMD
-            | WasmFeatures::MEMORY64
-            | WasmFeatures::CUSTOM_PAGE_SIZES
-            | WasmFeatures::WIDE_ARITHMETIC;
-        Validator::new_with_features(features)
+    fn validator(&self) -> Option<Validator> {
+        #[cfg(feature = "validate")]
+        {
+            let features = WasmFeatures::CALL_INDIRECT_OVERLONG
+                | WasmFeatures::BULK_MEMORY_OPT
+                | WasmFeatures::RELAXED_SIMD
+                | WasmFeatures::GC_TYPES
+                | WasmFeatures::REFERENCE_TYPES
+                | WasmFeatures::MUTABLE_GLOBAL
+                | WasmFeatures::MULTI_VALUE
+                | WasmFeatures::FLOATS
+                | WasmFeatures::BULK_MEMORY
+                | WasmFeatures::SATURATING_FLOAT_TO_INT
+                | WasmFeatures::SIGN_EXTENSION
+                | WasmFeatures::EXTENDED_CONST
+                | WasmFeatures::FUNCTION_REFERENCES
+                | WasmFeatures::TAIL_CALL
+                | WasmFeatures::MULTI_MEMORY
+                | WasmFeatures::SIMD
+                | WasmFeatures::MEMORY64
+                | WasmFeatures::CUSTOM_PAGE_SIZES
+                | WasmFeatures::WIDE_ARITHMETIC;
+            self.options.validation().then(|| Validator::new_with_features(features))
+        }
+        #[cfg(not(feature = "validate"))]
+        {
+            assert!(!self.options.validation(), "validation requires the `validate` feature");
+            None
+        }
     }
 
     #[cfg(feature = "std")]
@@ -194,7 +212,7 @@ impl Parser {
     /// Parse a [`Module`] from bytes
     pub fn parse_module_bytes(&self, wasm: impl AsRef<[u8]>) -> Result<Module> {
         let wasm = wasm.as_ref();
-        let mut validator = self.options.validation().then(|| Self::create_validator(self.options.clone()));
+        let mut validator = self.validator();
         let mut reader = ModuleReader::default();
 
         for payload in wasmparser::Parser::new(0).parse_all(wasm) {
@@ -228,7 +246,7 @@ impl Parser {
     #[cfg(feature = "std")]
     /// Parse a [`Module`] from a stream. Requires `std` feature.
     pub fn parse_module_stream(&self, mut stream: impl std::io::Read) -> Result<Module> {
-        let mut validator = self.options.validation().then(|| Self::create_validator(self.options.clone()));
+        let mut validator = self.validator();
         let mut reader = ModuleReader::default();
         let mut buffer = alloc::vec::Vec::new();
         let mut parser = wasmparser::Parser::new(0);

crates/parser/src/macros.rs

@@ -1,26 +1,24 @@
 pub(crate) mod visit {
+    #[cfg(feature = "validate")]
     macro_rules! validate_then_visit {
         ($( @$proposal:ident $op:ident $({ $($arg:ident: $argty:ty),* })? => $visit:ident ($($ann:tt)*))*) => {$(
             fn $visit(&mut self $($(,$arg: $argty)*)?) -> Self::Output {
-                if let Some(validator) = self.validator.as_mut() {
-                    if let Err(e) = validator.visitor(self.position).$visit($($($arg.clone()),*)?) {
-                        core::hint::cold_path();
-                        return Err(crate::ParseError::ParseError { message: e.to_string(), offset: self.position });
-                    }
+                if let Err(e) = self.validator.visitor(self.position).$visit($($($arg.clone()),*)?) {
+                    core::hint::cold_path();
+                    return Err(crate::ParseError::ParseError { message: e.to_string(), offset: self.position });
                 }
                 self.builder.$visit($($($arg),*)?)
             }
         )*};
     }
 
+    #[cfg(feature = "validate")]
     macro_rules! validate_then_visit_simd {
         ($( @$proposal:ident $op:ident $({ $($arg:ident: $argty:ty),* })? => $visit:ident ($($ann:tt)*))*) => {$(
             fn $visit(&mut self $($(,$arg: $argty)*)?) -> Self::Output {
-                if let Some(validator) = self.validator.as_mut() {
-                    if let Err(e) = validator.simd_visitor(self.position).$visit($($($arg.clone()),*)?) {
-                        core::hint::cold_path();
-                        return Err(crate::ParseError::ParseError { message: e.to_string(), offset: self.position });
-                    }
+                if let Err(e) = self.validator.simd_visitor(self.position).$visit($($($arg.clone()),*)?) {
+                    core::hint::cold_path();
+                    return Err(crate::ParseError::ParseError { message: e.to_string(), offset: self.position });
                 }
                 self.builder.$visit($($($arg),*)?)
             }
@@ -138,7 +136,9 @@ pub(crate) mod visit {
         };
     }
 
-    pub(crate) use {impl_visit_operator, lowering_ops, validate_then_visit, validate_then_visit_simd};
+    pub(crate) use {impl_visit_operator, lowering_ops};
+    #[cfg(feature = "validate")]
+    pub(crate) use {validate_then_visit, validate_then_visit_simd};
 }
 
 pub(crate) mod optimize {