Summary
The C++ Configure class exposes addForbiddenPlugins() and isForbiddenPlugins() to block specific plugins from loading at runtime. The CLI already uses this via --forbidden-plugin <name>. However, the C API (wasmedge_configure.h) has no equivalent functions, so embedders using Go, Rust, Python, or Java bindings cannot deny-list plugins programmatically.
Details
The gap can be verified directly in the source:
# C++ layer — both methods present
grep -n "ForbiddenPlugin" include/common/configure.h
# 325: void addForbiddenPlugins(std::string PluginName) noexcept;
# 330: bool isForbiddenPlugins(const std::string &PluginName) const noexcept;
# C API header — nothing found
grep -n "ForbiddenPlugin" include/api/wasmedge/wasmedge_configure.h
# (no output)
Proposed API Addition
Expose two new functions in include/api/wasmedge/wasmedge_configure.h:
/// Add a plugin name to the forbidden list.
WASMEDGE_CAPI_EXPORT extern void
WasmEdge_ConfigureAddForbiddenPlugin(
WasmEdge_ConfigureContext *Cxt,
const char *PluginName) WASMEDGE_CAPI_NOEXCEPT;
/// Check whether a plugin name is in the forbidden list.
WASMEDGE_CAPI_EXPORT extern bool
WasmEdge_ConfigureIsForbiddenPlugin(
const WasmEdge_ConfigureContext *Cxt,
const char *PluginName) WASMEDGE_CAPI_NOEXCEPT;
### Appendix
Related source locations:
- CLI usage: `lib/driver/toolConfig.cpp:138`
- Enforcement in VM: `lib/vm/vm.cpp:78`
- C++ API: `include/common/configure.h:325-333`
- C API header (gap): `include/api/wasmedge/wasmedge_configure.h`
- Reference pattern (EnableCoredump): same header, lines 211–251
Summary
The C++
Configureclass exposesaddForbiddenPlugins()andisForbiddenPlugins()to block specific plugins from loading at runtime. The CLI already uses this via--forbidden-plugin <name>. However, the C API (wasmedge_configure.h) has no equivalent functions, so embedders using Go, Rust, Python, or Java bindings cannot deny-list plugins programmatically.Details
The gap can be verified directly in the source: