github.com/bir3/gocompiler@v0.3.205/src/cmd/gocmd/internal/work/security.go (about) 1 // Copyright 2018 The Go Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style 3 // license that can be found in the LICENSE file. 4 5 // Checking of compiler and linker flags. 6 // We must avoid flags like -fplugin=, which can allow 7 // arbitrary code execution during the build. 8 // Do not make changes here without carefully 9 // considering the implications. 10 // (That's why the code is isolated in a file named security.go.) 11 // 12 // Note that -Wl,foo means split foo on commas and pass to 13 // the linker, so that -Wl,-foo,bar means pass -foo bar to 14 // the linker. Similarly -Wa,foo for the assembler and so on. 15 // If any of these are permitted, the wildcard portion must 16 // disallow commas. 17 // 18 // Note also that GNU binutils accept any argument @foo 19 // as meaning "read more flags from the file foo", so we must 20 // guard against any command-line argument beginning with @, 21 // even things like "-I @foo". 22 // We use load.SafeArg (which is even more conservative) 23 // to reject these. 24 // 25 // Even worse, gcc -I@foo (one arg) turns into cc1 -I @foo (two args), 26 // so although gcc doesn't expand the @foo, cc1 will. 27 // So out of paranoia, we reject @ at the beginning of every 28 // flag argument that might be split into its own argument. 29 30 package work 31 32 import ( 33 "fmt" 34 "github.com/bir3/gocompiler/src/internal/lazyregexp" 35 "regexp" 36 "strings" 37 38 "github.com/bir3/gocompiler/src/cmd/gocmd/internal/cfg" 39 "github.com/bir3/gocompiler/src/cmd/gocmd/internal/load" 40 ) 41 42 var re = lazyregexp.New 43 44 var validCompilerFlags = []*lazyregexp.Regexp{ 45 re(`-D([A-Za-z_][A-Za-z0-9_]*)(=[^@\-]*)?`), 46 re(`-U([A-Za-z_][A-Za-z0-9_]*)`), 47 re(`-F([^@\-].*)`), 48 re(`-I([^@\-].*)`), 49 re(`-O`), 50 re(`-O([^@\-].*)`), 51 re(`-W`), 52 re(`-W([^@,]+)`), // -Wall but not -Wa,-foo. 53 re(`-Wa,-mbig-obj`), 54 re(`-Wp,-D([A-Za-z_][A-Za-z0-9_]*)(=[^@,\-]*)?`), 55 re(`-Wp,-U([A-Za-z_][A-Za-z0-9_]*)`), 56 re(`-ansi`), 57 re(`-f(no-)?asynchronous-unwind-tables`), 58 re(`-f(no-)?blocks`), 59 re(`-f(no-)builtin-[a-zA-Z0-9_]*`), 60 re(`-f(no-)?common`), 61 re(`-f(no-)?constant-cfstrings`), 62 re(`-fdiagnostics-show-note-include-stack`), 63 re(`-f(no-)?eliminate-unused-debug-types`), 64 re(`-f(no-)?exceptions`), 65 re(`-f(no-)?fast-math`), 66 re(`-f(no-)?inline-functions`), 67 re(`-finput-charset=([^@\-].*)`), 68 re(`-f(no-)?fat-lto-objects`), 69 re(`-f(no-)?keep-inline-dllexport`), 70 re(`-f(no-)?lto`), 71 re(`-fmacro-backtrace-limit=(.+)`), 72 re(`-fmessage-length=(.+)`), 73 re(`-f(no-)?modules`), 74 re(`-f(no-)?objc-arc`), 75 re(`-f(no-)?objc-nonfragile-abi`), 76 re(`-f(no-)?objc-legacy-dispatch`), 77 re(`-f(no-)?omit-frame-pointer`), 78 re(`-f(no-)?openmp(-simd)?`), 79 re(`-f(no-)?permissive`), 80 re(`-f(no-)?(pic|PIC|pie|PIE)`), 81 re(`-f(no-)?plt`), 82 re(`-f(no-)?rtti`), 83 re(`-f(no-)?split-stack`), 84 re(`-f(no-)?stack-(.+)`), 85 re(`-f(no-)?strict-aliasing`), 86 re(`-f(un)signed-char`), 87 re(`-f(no-)?use-linker-plugin`), // safe if -B is not used; we don't permit -B 88 re(`-f(no-)?visibility-inlines-hidden`), 89 re(`-fsanitize=(.+)`), 90 re(`-ftemplate-depth-(.+)`), 91 re(`-fvisibility=(.+)`), 92 re(`-g([^@\-].*)?`), 93 re(`-m32`), 94 re(`-m64`), 95 re(`-m(abi|arch|cpu|fpu|tune)=([^@\-].*)`), 96 re(`-m(no-)?v?aes`), 97 re(`-marm`), 98 re(`-m(no-)?avx[0-9a-z]*`), 99 re(`-mfloat-abi=([^@\-].*)`), 100 re(`-mfpmath=[0-9a-z,+]*`), 101 re(`-m(no-)?avx[0-9a-z.]*`), 102 re(`-m(no-)?ms-bitfields`), 103 re(`-m(no-)?stack-(.+)`), 104 re(`-mmacosx-(.+)`), 105 re(`-mios-simulator-version-min=(.+)`), 106 re(`-miphoneos-version-min=(.+)`), 107 re(`-mtvos-simulator-version-min=(.+)`), 108 re(`-mtvos-version-min=(.+)`), 109 re(`-mwatchos-simulator-version-min=(.+)`), 110 re(`-mwatchos-version-min=(.+)`), 111 re(`-mnop-fun-dllimport`), 112 re(`-m(no-)?sse[0-9.]*`), 113 re(`-m(no-)?ssse3`), 114 re(`-mthumb(-interwork)?`), 115 re(`-mthreads`), 116 re(`-mwindows`), 117 re(`--param=ssp-buffer-size=[0-9]*`), 118 re(`-pedantic(-errors)?`), 119 re(`-pipe`), 120 re(`-pthread`), 121 re(`-?-std=([^@\-].*)`), 122 re(`-?-stdlib=([^@\-].*)`), 123 re(`--sysroot=([^@\-].*)`), 124 re(`-w`), 125 re(`-x([^@\-].*)`), 126 re(`-v`), 127 } 128 129 var validCompilerFlagsWithNextArg = []string{ 130 "-arch", 131 "-D", 132 "-U", 133 "-I", 134 "-F", 135 "-framework", 136 "-include", 137 "-isysroot", 138 "-isystem", 139 "--sysroot", 140 "-target", 141 "-x", 142 } 143 144 var validLinkerFlags = []*lazyregexp.Regexp{ 145 re(`-F([^@\-].*)`), 146 re(`-l([^@\-].*)`), 147 re(`-L([^@\-].*)`), 148 re(`-O`), 149 re(`-O([^@\-].*)`), 150 re(`-f(no-)?(pic|PIC|pie|PIE)`), 151 re(`-f(no-)?openmp(-simd)?`), 152 re(`-fsanitize=([^@\-].*)`), 153 re(`-flat_namespace`), 154 re(`-g([^@\-].*)?`), 155 re(`-headerpad_max_install_names`), 156 re(`-m(abi|arch|cpu|fpu|tune)=([^@\-].*)`), 157 re(`-mfloat-abi=([^@\-].*)`), 158 re(`-mmacosx-(.+)`), 159 re(`-mios-simulator-version-min=(.+)`), 160 re(`-miphoneos-version-min=(.+)`), 161 re(`-mthreads`), 162 re(`-mwindows`), 163 re(`-(pic|PIC|pie|PIE)`), 164 re(`-pthread`), 165 re(`-rdynamic`), 166 re(`-shared`), 167 re(`-?-static([-a-z0-9+]*)`), 168 re(`-?-stdlib=([^@\-].*)`), 169 re(`-v`), 170 171 // Note that any wildcards in -Wl need to exclude comma, 172 // since -Wl splits its argument at commas and passes 173 // them all to the linker uninterpreted. Allowing comma 174 // in a wildcard would allow tunneling arbitrary additional 175 // linker arguments through one of these. 176 re(`-Wl,--(no-)?allow-multiple-definition`), 177 re(`-Wl,--(no-)?allow-shlib-undefined`), 178 re(`-Wl,--(no-)?as-needed`), 179 re(`-Wl,-Bdynamic`), 180 re(`-Wl,-berok`), 181 re(`-Wl,-Bstatic`), 182 re(`-Wl,-Bsymbolic-functions`), 183 re(`-Wl,-O[0-9]+`), 184 re(`-Wl,-d[ny]`), 185 re(`-Wl,--disable-new-dtags`), 186 re(`-Wl,-e[=,][a-zA-Z0-9]+`), 187 re(`-Wl,--enable-new-dtags`), 188 re(`-Wl,--end-group`), 189 re(`-Wl,--(no-)?export-dynamic`), 190 re(`-Wl,-E`), 191 re(`-Wl,-framework,[^,@\-][^,]+`), 192 re(`-Wl,--hash-style=(sysv|gnu|both)`), 193 re(`-Wl,-headerpad_max_install_names`), 194 re(`-Wl,--no-undefined`), 195 re(`-Wl,-R,?([^@\-,][^,@]*$)`), 196 re(`-Wl,--just-symbols[=,]([^,@\-][^,@]+)`), 197 re(`-Wl,-rpath(-link)?[=,]([^,@\-][^,]+)`), 198 re(`-Wl,-s`), 199 re(`-Wl,-search_paths_first`), 200 re(`-Wl,-sectcreate,([^,@\-][^,]+),([^,@\-][^,]+),([^,@\-][^,]+)`), 201 re(`-Wl,--start-group`), 202 re(`-Wl,-?-static`), 203 re(`-Wl,-?-subsystem,(native|windows|console|posix|xbox)`), 204 re(`-Wl,-syslibroot[=,]([^,@\-][^,]+)`), 205 re(`-Wl,-undefined[=,]([^,@\-][^,]+)`), 206 re(`-Wl,-?-unresolved-symbols=[^,]+`), 207 re(`-Wl,--(no-)?warn-([^,]+)`), 208 re(`-Wl,-?-wrap[=,][^,@\-][^,]*`), 209 re(`-Wl,-z,(no)?execstack`), 210 re(`-Wl,-z,relro`), 211 212 re(`[a-zA-Z0-9_/].*\.(a|o|obj|dll|dylib|so|tbd)`), // direct linker inputs: x.o or libfoo.so (but not -foo.o or @foo.o) 213 re(`\./.*\.(a|o|obj|dll|dylib|so|tbd)`), 214 } 215 216 var validLinkerFlagsWithNextArg = []string{ 217 "-arch", 218 "-F", 219 "-l", 220 "-L", 221 "-framework", 222 "-isysroot", 223 "--sysroot", 224 "-target", 225 "-Wl,-framework", 226 "-Wl,-rpath", 227 "-Wl,-R", 228 "-Wl,--just-symbols", 229 "-Wl,-undefined", 230 } 231 232 func checkCompilerFlags(name, source string, list []string) error { 233 checkOverrides := true 234 return checkFlags(name, source, list, validCompilerFlags, validCompilerFlagsWithNextArg, checkOverrides) 235 } 236 237 func checkLinkerFlags(name, source string, list []string) error { 238 checkOverrides := true 239 return checkFlags(name, source, list, validLinkerFlags, validLinkerFlagsWithNextArg, checkOverrides) 240 } 241 242 // checkCompilerFlagsForInternalLink returns an error if 'list' 243 // contains a flag or flags that may not be fully supported by 244 // internal linking (meaning that we should punt the link to the 245 // external linker). 246 func checkCompilerFlagsForInternalLink(name, source string, list []string) error { 247 checkOverrides := false 248 if err := checkFlags(name, source, list, validCompilerFlags, validCompilerFlagsWithNextArg, checkOverrides); err != nil { 249 return err 250 } 251 // Currently the only flag on the allow list that causes problems 252 // for the linker is "-flto"; check for it manually here. 253 for _, fl := range list { 254 if strings.HasPrefix(fl, "-flto") { 255 return fmt.Errorf("flag %q triggers external linking", fl) 256 } 257 } 258 return nil 259 } 260 261 func checkFlags(name, source string, list []string, valid []*lazyregexp.Regexp, validNext []string, checkOverrides bool) error { 262 // Let users override rules with $CGO_CFLAGS_ALLOW, $CGO_CFLAGS_DISALLOW, etc. 263 var ( 264 allow *regexp.Regexp 265 disallow *regexp.Regexp 266 ) 267 if checkOverrides { 268 if env := cfg.Getenv("CGO_" + name + "_ALLOW"); env != "" { 269 r, err := regexp.Compile(env) 270 if err != nil { 271 return fmt.Errorf("parsing $CGO_%s_ALLOW: %v", name, err) 272 } 273 allow = r 274 } 275 if env := cfg.Getenv("CGO_" + name + "_DISALLOW"); env != "" { 276 r, err := regexp.Compile(env) 277 if err != nil { 278 return fmt.Errorf("parsing $CGO_%s_DISALLOW: %v", name, err) 279 } 280 disallow = r 281 } 282 } 283 284 Args: 285 for i := 0; i < len(list); i++ { 286 arg := list[i] 287 if disallow != nil && disallow.FindString(arg) == arg { 288 goto Bad 289 } 290 if allow != nil && allow.FindString(arg) == arg { 291 continue Args 292 } 293 for _, re := range valid { 294 if re.FindString(arg) == arg { // must be complete match 295 continue Args 296 } 297 } 298 for _, x := range validNext { 299 if arg == x { 300 if i+1 < len(list) && load.SafeArg(list[i+1]) { 301 i++ 302 continue Args 303 } 304 305 // Permit -Wl,-framework -Wl,name. 306 if i+1 < len(list) && 307 strings.HasPrefix(arg, "-Wl,") && 308 strings.HasPrefix(list[i+1], "-Wl,") && 309 load.SafeArg(list[i+1][4:]) && 310 !strings.Contains(list[i+1][4:], ",") { 311 i++ 312 continue Args 313 } 314 315 // Permit -I= /path, -I $SYSROOT. 316 if i+1 < len(list) && arg == "-I" { 317 if (strings.HasPrefix(list[i+1], "=") || strings.HasPrefix(list[i+1], "$SYSROOT")) && 318 load.SafeArg(list[i+1][1:]) { 319 i++ 320 continue Args 321 } 322 } 323 324 if i+1 < len(list) { 325 return fmt.Errorf("invalid flag in %s: %s %s (see https://golang.org/s/invalidflag)", source, arg, list[i+1]) 326 } 327 return fmt.Errorf("invalid flag in %s: %s without argument (see https://golang.org/s/invalidflag)", source, arg) 328 } 329 } 330 Bad: 331 return fmt.Errorf("invalid flag in %s: %s", source, arg) 332 } 333 return nil 334 }