Skip to content

Security

Keys edited this page Jul 31, 2026 · 1 revision

Security

shell.js reduces what shell input can reach, but it is not a sandbox for arbitrary JavaScript.

Trust model

Input Treatment
Shell command text Parsed without eval; bounded by source, token, command, runtime, and output limits
Paths and redirects Resolved inside MemoryFS; no host filesystem access
Built-in commands No host processes or implicit network commands
Custom handlers Trusted host-page code with the capabilities the application gives them
Manual packs Build-time pinned and hashed; runtime indexes and paths are validated and size-limited
WebAssembly Optional, ABI-checked, and best self-hosted or version-pinned

Timeouts can stop awaiting a handler, but JavaScript cannot preempt synchronous work already running. Custom handlers should remain bounded and honor the provided AbortSignal when they perform asynchronous work.

The supplied DOM adapter writes output with textContent. A custom UI must preserve that rule or perform its own strict sanitization.

Deployment checklist

  • Set a Content Security Policy suitable for the host application.
  • Keep untrusted command implementations outside the page, or isolate them in a stronger boundary such as a Worker or separate origin.
  • Configure tighter shell and filesystem limits when the default ceilings are larger than the application needs.
  • Treat remote manual packs and Wasm URLs as supply-chain inputs; pin or self-host them.
  • Do not present an OS profile as a real FreeBSD or Linux security boundary.

Reporting

Supported releases receive fixes on the latest major line. Report suspected vulnerabilities through a private GitHub security advisory with affected versions, impact, and reproduction steps. Do not open a public issue before a fix is available.

Clone this wiki locally