Add controls for WASM #1814

Despite the inherent issues with script safety, especially with unauthenticated blobs of bytecode, the increasing prevalence of WASM on the web demands that we enable it for web compatibility.
Extending the functionality of the traditional browser model to run arbitrary code - in this case, WebAssembly - once again expands the local attack surface for web-borne exploits.
So should we just throw up our hands and go with the program?
Yes, apparently we have to.

After examining the security issues with it and verifying that currently-known CVEs with it are addressed, I've come to the conclusion that aside from a known issue in the JIT compiler on 32-bit platforms, it should be safe to enable by default.
This does need an added control in preferences (probably under content) for people to easily enable/disable WASM content, and the JIT should be off by default on 32-bit platforms.

Despite the inherent issues with script safety, especially with unauthenticated blobs of bytecode, the increasing prevalence of WASM on the web demands that we enable it for web compatibility. Extending the functionality of the traditional browser model to run arbitrary code - in this case, WebAssembly - once again expands the local attack surface for web-borne exploits. So should we just throw up our hands and go with the program? Yes, apparently we have to. After examining the security issues with it and verifying that currently-known CVEs with it are addressed, I've come to the conclusion that aside from a known issue in the JIT compiler on 32-bit platforms, it should be safe to enable by default. This does need an added control in preferences (probably under content) for people to easily enable/disable WASM content, and the JIT should be off by default on 32-bit platforms.

I am preserving this issue but splitting off the Platform bits to another issue.

Pale Moon bits are as follows, add tickbox to Preferences -> Content for javascript.options.wasm plus strings.

I am preserving this issue but splitting off the Platform bits to another issue. Pale Moon bits are as follows, add tickbox to Preferences -> Content for `javascript.options.wasm` plus strings.

@JustOff

Strings changes were pushed to CrowdIn.

Labels Milestones

Add controls for WASM #1814