{"record":{"id":"a4433551c2eaf983","repo":"astrid-runtime/astrid","slug":"unsafe-wasm-artifact-name-output-name","errorCode":null,"errorMessage":"Unsafe WASM artifact name: {output_name}","messagePattern":"Unsafe WASM artifact name: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-build/src/rust.rs","lineNumber":182,"sourceCode":"    I: IntoIterator<Item = String>,\n{\n    let output_names: Vec<String> = output_names.into_iter().collect();\n    match output_names.as_slice() {\n        [] => bail!(\"Capsule has no cdylib target; refusing to guess a WASM artifact\"),\n        [output_name] => validate_wasm_output_name(output_name),\n        _ => bail!(\n            \"Capsule has {} cdylib targets; refusing to choose an ambiguous WASM artifact\",\n            output_names.len()\n        ),\n    }\n}\n\nfn validate_wasm_output_name(output_name: &str) -> Result<String> {\n    let path = Path::new(output_name);\n    let is_single_normal_component =\n        output_name != \".\" && output_name != \"..\" && path.file_name() == Some(path.as_os_str());\n    if !is_single_normal_component {\n        bail!(\"Unsafe WASM artifact name: {output_name}\");\n    }\n    Ok(output_name.to_owned())\n}\n\n/// Compile the capsule in release mode using whatever target Cargo resolves\n/// from its complete configuration hierarchy.\n///\n/// The Astrid-canonical target is `wasm32-unknown-unknown` — zero\n/// `wasi:*` imports, every host call audited through the\n/// `astrid:*` SDK surface. Capsules may also target `wasm32-wasip2`\n/// during the migration window (the kernel still satisfies wasi:*\n/// for backwards compatibility), so this build step does NOT pass\n/// `--target`; it lets Cargo's own config and environment precedence decide.\n///\n/// When the capsule targets `wasm32-unknown-unknown` it additionally\n/// injects the getrandom custom-backend cfg through target-wide rustflags so\n/// `astrid build` succeeds even when a capsule's `.cargo/config.toml` is\n/// missing `--cfg=getrandom_backend=\"custom\"`. This is a safety net for the","sourceCodeStart":164,"sourceCodeEnd":200,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-build/src/rust.rs#L164-L200","documentation":"Fired by validate_wasm_output_name when the cdylib output name is not a single safe path component (e.g. contains `/`, `..`, or is otherwise path-hostile). Prevents manifest/archive paths from escaping the package layout.","triggerScenarios":"Thrown at crates/astrid-build/src/rust.rs:182 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Rename the library with `[lib] name = \"simple_name\"` using only safe identifier characters","Remove path separators or traversal sequences from the output name","Rebuild after fixing the name"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}