Skip to content

Implement validation of custom sections - #2668

Merged
alexcrichton merged 2 commits into
bytecodealliance:mainfrom
alexcrichton:validate-custom-sections
Sep 17, 2026
Merged

alexcrichton merged 2 commits into
bytecodealliance:mainfrom
alexcrichton:validate-custom-sections

Conversation

@alexcrichton

Copy link
Copy Markdown
Member

Custom sections aren't validated by default in WebAssembly, but upstream spec tests have an assert_invalid_custom directive for still indicating whether a custom section is intended to be invalid or not. Additionally for custom sections like the name section the upstream specification still specifies validity criteria. Previously wasm-tools wast did not implement the assert_invalid_custom directive, simply succeeding on it, and there was no validation of any custom sections.

This commit addresses this by implementing the assert_invalid_custom directive, adding a --validate-custom flag to wasm-tools validate, and otherwise implementing validation for custom sections. This is done in such a way to avoid impacting main module validation and is additionally something embedders must opt-in to executing, if even. My hunch is that most embedders won't bother with this and this'll be a niche-useful command line flag but that's pretty much it.

Custom sections aren't validated by default in WebAssembly, but upstream
spec tests have an `assert_invalid_custom` directive for still
indicating whether a custom section is intended to be invalid or not.
Additionally for custom sections like the `name` section the upstream
specification still specifies validity criteria. Previously `wasm-tools
wast` did not implement the `assert_invalid_custom` directive, simply
succeeding on it, and there was no validation of any custom sections.

This commit addresses this by implementing the `assert_invalid_custom`
directive, adding a `--validate-custom` flag to `wasm-tools validate`,
and otherwise implementing validation for custom sections. This is done
in such a way to avoid impacting main module validation and is
additionally something embedders must opt-in to executing, if even. My
hunch is that most embedders won't bother with this and this'll be a
niche-useful command line flag but that's pretty much it.
@alexcrichton
alexcrichton requested a review from a team as a code owner September 17, 2026 16:01
@alexcrichton
alexcrichton requested review from dicej and removed request for a team September 17, 2026 16:01
@alexcrichton
alexcrichton added this pull request to the merge queue Sep 17, 2026
Merged via the queue into bytecodealliance:main with commit 5b9827a Sep 17, 2026
37 checks passed
@alexcrichton
alexcrichton deleted the validate-custom-sections branch September 17, 2026 18:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants