WASI `inheritSystem()` warnings are incorrect

[Marcono1234]

At two places in the documentation there are warnings about using WASI builder inheritSystem():

• endive/docs/docs/experimental/cli.md

  Line 9 in 7505798

  The experimental CLI uses `inheritSystem()` by default, granting the Wasm module full access to the host filesystem, environment, and stdio. Do not use it with untrusted modules in its current form.

• endive/docs/docs/security/best-practices.md

  Line 57 in 7505798

  **Never use `inheritSystem()` with untrusted modules** — it grants full host filesystem, environment, and stdio access.

However, inheritSystem() only seems to inherit stdout, stderr and stdin but not the filesystem or environment variables:

endive/wasi/src/main/java/run/endive/wasi/WasiOptions.java

Lines 170 to 175 in 7505798

	public Builder inheritSystem() {
	this.stdout = System.out;
	this.stdin = System.in;
	this.stderr = System.err;
	return this;
	}

Or am I overlooking something? Could be the case of course that the CLI additionally provides access to the host file system, but that is unrelated to inheritSystem() then?

(As side note: It would also be good if inheritSystem() and also other parts of the API had Javadoc to make it clearer what they do and how to use them. But I guess that might be a bigger project.)

[andreaTP]

inheritSystem() comes, simply, from organic growth 🙂 .

Forwarding environment variables sounds interesting(but potentially dangerous) and mapping file system is a no-go since we rely on a VFS and not the host FS.

[Marcono1234]

Forwarding environment variables sounds interesting(but potentially dangerous) and mapping file system is a no-go since we rely on a VFS and not the host FS.

Yes I agree, both sounds dangerous. My intention was not to suggest changing inheritSystem() behavior or adding new API with that dangerous functionality.

Should I (or do you want to) update the documentation linked above then to remove the warnings about inheritSystem() which erroneously suggest the method does actually provide access to all environment variables and the OS file system?

[andreaTP]

A PR would be very welcome!