Stream: git-wasmtime

Topic: wasmtime / PR #14727 Be more strict about parsing path-wi...

Wasmtime GitHub notifications bot (Oct 14 2026 at 15:15):

alexcrichton opened PR #14727 from alexcrichton:fix-path-with-query to bytecodealliance:main:

This commit updates the handling of the set-path-with-query WIT function in WASIp{2,3} to require that the path specified starts with /, ?, or is empty. This isn't checked by the http crate for us, so it needs to be manually done in Wasmtime.

<!--
Please make sure you include the following information:

• If this work has been discussed elsewhere, please include a link to that
  conversation. If it was discussed in an issue, just mention "issue #...".

• Explain why this change is needed. If the details are in an issue already,
  this can be brief.

Our development process is documented in the Wasmtime book:
https://docs.wasmtime.dev/contributing-development-process.html

Please review the Bytecode Alliance's AI tool usage policy at
https://github.com/bytecodealliance/governance/blob/main/AI_TOOL_POLICY.md

Please ensure all communication follows the code of conduct:
https://github.com/bytecodealliance/wasmtime/blob/main/CODE_OF_CONDUCT.md
-->

Wasmtime GitHub notifications bot (Oct 14 2026 at 15:15):

alexcrichton requested wasmtime-wasi-reviewers for a review on PR #14727.

Wasmtime GitHub notifications bot (Oct 14 2026 at 15:15):

alexcrichton requested rvolosatovs for a review on PR #14727.

Wasmtime GitHub notifications bot (Oct 14 2026 at 15:15):

alexcrichton requested pchickey for a review on PR #14727.

Wasmtime GitHub notifications bot (Oct 14 2026 at 15:15):

alexcrichton requested wasmtime-core-reviewers for a review on PR #14727.

Wasmtime GitHub notifications bot (Oct 14 2026 at 15:16):

alexcrichton edited PR #14727:

This commit updates the handling of the set-path-with-query WIT function in WASIp{2,3} to require that the path specified starts with /, ?, or is empty. This isn't checked by the http crate for us, so it needs to be manually done in Wasmtime.

Part of https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5qpp-g3j2-8frx
<!--
Please make sure you include the following information:

• If this work has been discussed elsewhere, please include a link to that
  conversation. If it was discussed in an issue, just mention "issue #...".

• Explain why this change is needed. If the details are in an issue already,
  this can be brief.

Our development process is documented in the Wasmtime book:
https://docs.wasmtime.dev/contributing-development-process.html

Please review the Bytecode Alliance's AI tool usage policy at
https://github.com/bytecodealliance/governance/blob/main/AI_TOOL_POLICY.md

Please ensure all communication follows the code of conduct:
https://github.com/bytecodealliance/wasmtime/blob/main/CODE_OF_CONDUCT.md
-->

Wasmtime GitHub notifications bot (Oct 14 2026 at 15:43):

:thumbs_up: rvolosatovs submitted PR review.

Wasmtime GitHub notifications bot (Oct 14 2026 at 15:49):

alexcrichton updated PR #14727.

Wasmtime GitHub notifications bot (Oct 14 2026 at 15:51):

alexcrichton has enabled auto merge for PR #14727.

Wasmtime GitHub notifications bot (Oct 14 2026 at 16:00):

alexcrichton added PR #14727 Be more strict about parsing path-with-query to the merge queue.

Wasmtime GitHub notifications bot (Oct 14 2026 at 16:23):

:check: alexcrichton merged PR #14727.

Wasmtime GitHub notifications bot (Oct 14 2026 at 16:23):

alexcrichton removed PR #14727 Be more strict about parsing path-with-query from the merge queue.

Last updated: Oct 31 2026 at 23:03 UTC