[Proposal] Add comprehensive testing guide for WebAssembly (Wasm) #1483

What would you like added?
A testing guide for WebAssembly (Wasm). Despite being a W3C standard heavily used in modern web apps, WSTG currently lacks a methodology for auditing it.

The initial proposed content:

1. Static Analysis: Extracting .wasm modules and analyzing the WebAssembly binary/WAT representation for security-relevant logic, imports, exports, and embedded data.
2. JavaScript–Wasm Boundary Testing: Testing interactions between JavaScript and Wasm, including unsafe imports/exports, type confusion, and DOM-related attack paths.
3. Linear Memory & Memory Safety: Testing for out-of-bounds access, memory corruption, unsafe memory handling, and logic flaws that can affect application security.
4. Information Disclosure: Identifying sensitive data, secrets, credentials, debug information, or proprietary logic exposed within WebAssembly modules.
5. Wasm Module & Supply-Chain Security: Assessing how Wasm modules are loaded, delivered, validated, and updated, including risks from untrusted or tampered modules.
   (Note: I am researching further Wasm attack vectors, so this outline might evolve.)

Proposed Placement:
Since Wasm introduces a distinct client-side execution model, including compiled code and linear memory, I propose a new top-level chapter (e.g., 4.13 Testing WebAssembly).

However, if the Project Leader prefers keeping it within the existing architecture, I am completely fine adding it as a sub-section (e.g., 4.11.16). Let me know your preference!

Would you like to be assigned to this issue?

• Assign me, please!