Separate enabling/disabling of WASM for extensions and sites

[emanruse]

Is your feature request related to a problem? Please describe. Some extensions like uBlockOrigin use WebAssembly. However a security minded person may want to disable WASM (through command line option --js-flags=--noexpose_wasm) because of:

https://www.infoq.com/news/2019/10/WebAssembly-wasm-malicious-usage/ https://www.dimva2019.org/wp-content/uploads/sites/31/2019/06/DIMVA19-slides-2-R.pdf

Unfortunately this also disables WASM for extensions.

Describe the solution you'd like 2 flags:

• enable/disable WASM for extensions
• enable/disable WASM for websites

[wchen342]

Just out of curiosity, what feature of uBlockOrigin requires WASM? Because I am using it without WebAssembly on both Firefox and Ungoogled-Chromium and I wonder what I missed.

EDIT: I saw the issue you opened. An interesing discovery. If I understand correctly in the specific case of uBlockOrigin it only means it cannot do blocking with WASM (which is useless anyway since you disabled WASM completely).

[emanruse]

Just out of curiosity, what feature of uBlockOrigin requires WASM?

You should probably ask the developers as I am not familiar with the source code. All I know is that they started using it at some point in time for performance optimization.

[jstkdng]

probably rule parsing as some rule sets tend to be thousands of lines long, maybe millions

[Eloston]

I suppose this could be useful, but we still need to see how feasible this is to implement. These flags would toggle features at the core of the browser (V8 perhaps?) so it may not be easy.