As part of ISE-Sandboxing's Sandboxing Enforcement Program (go/ise-sandboxing-enforcement), we have identified the hunspell library as a target that requires sandboxing if processing data originating from outside of Alphabet. This is in accordance with our guideline go/untrusted-workloads.
This package contains a sandboxed version of the spellcheck APIs of //third_party/hunspell:hunspell.
Sandboxing hunspell provides an additional security boundary that requires a malicious actor to successfully exploit two vulnerabilities before they are able to laterally move away from the initial entry point.
TODO: Update the next paragraph depending on the sapi_library target in BUILD.
The sandboxed_hunspell (//third_party/hunspell/sandbox:sandboxed_hunspell) library provides only a subset of the unsandboxed read/decode APIs. This subset is listed in the functions argument of the sapi_library BUILD rule. If more functions are needed, reach out to ISE Sandboxing (go/ise-sandboxing) for guidance.
This is the SAPI implementation of //third_party/hunspell:hunspell and provides users of the sandboxed API with the most control with regards to the sandbox's life-time and the possibility to implement additional customizations. This comes at the cost of simplicity.
Follow these steps:
In your BUILD file, add the target to your deps list:
"//third_party/hunspell/sandbox:sandboxed_hunspell",
Add the library headers in your source files:
#include "third_party/hunspell/sandbox/sandbox.h" #include "third_party/hunspell/sandbox/sandboxed_hunspell.sapi.h"
Create and then initialize the sandbox.
sandboxed_hunspell::LibHunspellSapiSandbox sbx; SAPI_RETURN_IF_ERROR(sbx.Init());
Create the API object with the initialized sandbox:
sandboxed_hunspell::LibHunspellApi api(&sbx);
Prepare the SAPI variables for the sandboxed API function call. For an explanation of SAPI variables, please consult go/sapi/variables.
std::string s_afn = "utf8.aff";
std::string s_dfn = "utf8.dic";
sapi::v::ConstCStr c_afn(s_afn.c_str());
sapi::v::ConstCStr c_dfn(s_dfn.c_str());
SAPI_ASSERT_OK_AND_ASSIGN(
sandboxed_hunspell::Hunhandle * hunspell,
api.Hunspell_create(c_afn.PtrBefore(), c_dfn.PtrBefore()));
This tests the basic functionality of the sandboxed_hunspell and compares the output to the unsandboxed hunspell. It is also a good source to understand how the SAPI variables need to be prepared.