“Untrusted code constantly seeks to exploit communication gaps between OS components. The best defense is to refuse dynamic shell environments.”

Threat Model

Windows installers (`.exe` or `.msi`) downloaded from the internet are treated as "untrusted code" by WinNest. Although Wine translates Windows API calls to run applications natively on Linux, these Windows processes still run under the privileges of the active Linux user and can read/write system directories unless explicitly restricted.

WinNest's security goal is to prevent Windows applications or malicious arguments from accessing or mutating host Linux directories without authorization.

Safe Spawning Principles

The most common security vulnerability when writing CLI wrappers that call external processes is executing raw shell strings (e.g. `child_process.exec("wine " + installerPath)`). If `installerPath` contains special shell characters like semicolons `;`, ampersands `&`, or spaces combined with system binaries, an attacker can inject malicious payloads to run directly on the Linux shell.

WinNest eliminates this risk completely by enforcing a **Safe Spawning** policy:

// ❌ UNSECURE: Vulnerable to Shell Injection
exec(`wine ${installerPath} /S`);

//  SECURE: WinNest utilizes separated argument arrays
const proc = spawn("wine", [installerPath, "/S"], {
  shell: false, // Disables the Linux Shell command interpreter
  cwd: appDir
});

By setting `shell: false` and passing arguments as an array of distinct strings, the Linux kernel passes these parameters directly to the process argument vector (`argv`) without processing them through any command-line shell (like bash or sh). This eliminates command injection possibilities.

Sandbox Limits

To isolate Windows applications' read/write activities, WinNest implements the following boundaries on Wine Prefixes:

• Registry Isolation: Each application runs on its own virtual Registry database. Malicious registry registrations inside one prefix do not affect other apps.
• Drive Mapping Control: Disables or limits the auto-mapping of host Linux directories (such as `/` or the user's home folder) to virtual Windows drive letters like `D:` or `E:`, unless explicitly permitted by the user.
• DLL Override Mitigation: Prevents malicious Windows system DLLs from being loaded by prioritizing Wine's native (builtin) libraries over bundled overrides.