github.com/mangodowner/go-gm@v0.0.0-20180818020936-8baa2bd4408c/src/cmd/go/internal/work/security.go (about) 1 // Copyright 2018 The Go Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style 3 // license that can be found in the LICENSE file. 4 5 // Checking of compiler and linker flags. 6 // We must avoid flags like -fplugin=, which can allow 7 // arbitrary code execution during the build. 8 // Do not make changes here without carefully 9 // considering the implications. 10 // (That's why the code is isolated in a file named security.go.) 11 // 12 // Note that -Wl,foo means split foo on commas and pass to 13 // the linker, so that -Wl,-foo,bar means pass -foo bar to 14 // the linker. Similarly -Wa,foo for the assembler and so on. 15 // If any of these are permitted, the wildcard portion must 16 // disallow commas. 17 // 18 // Note also that GNU binutils accept any argument @foo 19 // as meaning "read more flags from the file foo", so we must 20 // guard against any command-line argument beginning with @, 21 // even things like "-I @foo". 22 // We use load.SafeArg (which is even more conservative) 23 // to reject these. 24 // 25 // Even worse, gcc -I@foo (one arg) turns into cc1 -I @foo (two args), 26 // so although gcc doesn't expand the @foo, cc1 will. 27 // So out of paranoia, we reject @ at the beginning of every 28 // flag argument that might be split into its own argument. 29 30 package work 31 32 import ( 33 "cmd/go/internal/load" 34 "fmt" 35 "os" 36 "regexp" 37 "strings" 38 ) 39 40 var re = regexp.MustCompile 41 42 var validCompilerFlags = []*regexp.Regexp{ 43 re(`-D([A-Za-z_].*)`), 44 re(`-F([^@\-].*)`), 45 re(`-I([^@\-].*)`), 46 re(`-O`), 47 re(`-O([^@\-].*)`), 48 re(`-W`), 49 re(`-W([^@,]+)`), // -Wall but not -Wa,-foo. 50 re(`-Wa,-mbig-obj`), 51 re(`-Wp,-D([A-Za-z_].*)`), 52 re(`-ansi`), 53 re(`-f(no-)?asynchronous-unwind-tables`), 54 re(`-f(no-)?blocks`), 55 re(`-f(no-)builtin-[a-zA-Z0-9_]*`), 56 re(`-f(no-)?common`), 57 re(`-f(no-)?constant-cfstrings`), 58 re(`-fdiagnostics-show-note-include-stack`), 59 re(`-f(no-)?eliminate-unused-debug-types`), 60 re(`-f(no-)?exceptions`), 61 re(`-f(no-)?fast-math`), 62 re(`-f(no-)?inline-functions`), 63 re(`-finput-charset=([^@\-].*)`), 64 re(`-f(no-)?fat-lto-objects`), 65 re(`-f(no-)?keep-inline-dllexport`), 66 re(`-f(no-)?lto`), 67 re(`-fmacro-backtrace-limit=(.+)`), 68 re(`-fmessage-length=(.+)`), 69 re(`-f(no-)?modules`), 70 re(`-f(no-)?objc-arc`), 71 re(`-f(no-)?objc-nonfragile-abi`), 72 re(`-f(no-)?objc-legacy-dispatch`), 73 re(`-f(no-)?omit-frame-pointer`), 74 re(`-f(no-)?openmp(-simd)?`), 75 re(`-f(no-)?permissive`), 76 re(`-f(no-)?(pic|PIC|pie|PIE)`), 77 re(`-f(no-)?plt`), 78 re(`-f(no-)?rtti`), 79 re(`-f(no-)?split-stack`), 80 re(`-f(no-)?stack-(.+)`), 81 re(`-f(no-)?strict-aliasing`), 82 re(`-f(un)signed-char`), 83 re(`-f(no-)?use-linker-plugin`), // safe if -B is not used; we don't permit -B 84 re(`-f(no-)?visibility-inlines-hidden`), 85 re(`-fsanitize=(.+)`), 86 re(`-ftemplate-depth-(.+)`), 87 re(`-fvisibility=(.+)`), 88 re(`-g([^@\-].*)?`), 89 re(`-m32`), 90 re(`-m64`), 91 re(`-m(abi|arch|cpu|fpu|tune)=([^@\-].*)`), 92 re(`-marm`), 93 re(`-mfloat-abi=([^@\-].*)`), 94 re(`-mfpmath=[0-9a-z,+]*`), 95 re(`-m(no-)?avx[0-9a-z.]*`), 96 re(`-m(no-)?ms-bitfields`), 97 re(`-m(no-)?stack-(.+)`), 98 re(`-mmacosx-(.+)`), 99 re(`-mios-simulator-version-min=(.+)`), 100 re(`-miphoneos-version-min=(.+)`), 101 re(`-mnop-fun-dllimport`), 102 re(`-m(no-)?sse[0-9.]*`), 103 re(`-mthumb(-interwork)?`), 104 re(`-mthreads`), 105 re(`-mwindows`), 106 re(`--param=ssp-buffer-size=[0-9]*`), 107 re(`-pedantic(-errors)?`), 108 re(`-pipe`), 109 re(`-pthread`), 110 re(`-?-std=([^@\-].*)`), 111 re(`-?-stdlib=([^@\-].*)`), 112 re(`--sysroot=([^@\-].*)`), 113 re(`-w`), 114 re(`-x([^@\-].*)`), 115 } 116 117 var validCompilerFlagsWithNextArg = []string{ 118 "-arch", 119 "-D", 120 "-I", 121 "-framework", 122 "-isysroot", 123 "-isystem", 124 "--sysroot", 125 "-target", 126 "-x", 127 } 128 129 var validLinkerFlags = []*regexp.Regexp{ 130 re(`-F([^@\-].*)`), 131 re(`-l([^@\-].*)`), 132 re(`-L([^@\-].*)`), 133 re(`-O`), 134 re(`-O([^@\-].*)`), 135 re(`-f(no-)?(pic|PIC|pie|PIE)`), 136 re(`-f(no-)?openmp(-simd)?`), 137 re(`-fsanitize=([^@\-].*)`), 138 re(`-g([^@\-].*)?`), 139 re(`-headerpad_max_install_names`), 140 re(`-m(abi|arch|cpu|fpu|tune)=([^@\-].*)`), 141 re(`-mfloat-abi=([^@\-].*)`), 142 re(`-mmacosx-(.+)`), 143 re(`-mios-simulator-version-min=(.+)`), 144 re(`-miphoneos-version-min=(.+)`), 145 re(`-mthreads`), 146 re(`-mwindows`), 147 re(`-(pic|PIC|pie|PIE)`), 148 re(`-pthread`), 149 re(`-rdynamic`), 150 re(`-shared`), 151 re(`-?-static([-a-z0-9+]*)`), 152 re(`-?-stdlib=([^@\-].*)`), 153 154 // Note that any wildcards in -Wl need to exclude comma, 155 // since -Wl splits its argument at commas and passes 156 // them all to the linker uninterpreted. Allowing comma 157 // in a wildcard would allow tunnelling arbitrary additional 158 // linker arguments through one of these. 159 re(`-Wl,--(no-)?allow-multiple-definition`), 160 re(`-Wl,--(no-)?allow-shlib-undefined`), 161 re(`-Wl,--(no-)?as-needed`), 162 re(`-Wl,-Bdynamic`), 163 re(`-Wl,-Bstatic`), 164 re(`-WL,-O([^@,\-][^,]*)?`), 165 re(`-Wl,-d[ny]`), 166 re(`-Wl,--disable-new-dtags`), 167 re(`-Wl,-e[=,][a-zA-Z0-9]*`), 168 re(`-Wl,--enable-new-dtags`), 169 re(`-Wl,--end-group`), 170 re(`-Wl,-framework,[^,@\-][^,]+`), 171 re(`-Wl,-headerpad_max_install_names`), 172 re(`-Wl,--no-undefined`), 173 re(`-Wl,-rpath(-link)?[=,]([^,@\-][^,]+)`), 174 re(`-Wl,-s`), 175 re(`-Wl,-search_paths_first`), 176 re(`-Wl,-sectcreate,([^,@\-][^,]+),([^,@\-][^,]+),([^,@\-][^,]+)`), 177 re(`-Wl,--start-group`), 178 re(`-Wl,-?-static`), 179 re(`-Wl,-?-subsystem,(native|windows|console|posix|xbox)`), 180 re(`-Wl,-syslibroot[=,]([^,@\-][^,]+)`), 181 re(`-Wl,-undefined[=,]([^,@\-][^,]+)`), 182 re(`-Wl,-?-unresolved-symbols=[^,]+`), 183 re(`-Wl,--(no-)?warn-([^,]+)`), 184 re(`-Wl,-z,(no)?execstack`), 185 re(`-Wl,-z,relro`), 186 187 re(`[a-zA-Z0-9_/].*\.(a|o|obj|dll|dylib|so)`), // direct linker inputs: x.o or libfoo.so (but not -foo.o or @foo.o) 188 re(`\./.*\.(a|o|obj|dll|dylib|so)`), 189 } 190 191 var validLinkerFlagsWithNextArg = []string{ 192 "-arch", 193 "-F", 194 "-l", 195 "-L", 196 "-framework", 197 "-isysroot", 198 "--sysroot", 199 "-target", 200 "-Wl,-framework", 201 "-Wl,-rpath", 202 "-Wl,-undefined", 203 } 204 205 func checkCompilerFlags(name, source string, list []string) error { 206 return checkFlags(name, source, list, validCompilerFlags, validCompilerFlagsWithNextArg) 207 } 208 209 func checkLinkerFlags(name, source string, list []string) error { 210 return checkFlags(name, source, list, validLinkerFlags, validLinkerFlagsWithNextArg) 211 } 212 213 func checkFlags(name, source string, list []string, valid []*regexp.Regexp, validNext []string) error { 214 // Let users override rules with $CGO_CFLAGS_ALLOW, $CGO_CFLAGS_DISALLOW, etc. 215 var ( 216 allow *regexp.Regexp 217 disallow *regexp.Regexp 218 ) 219 if env := os.Getenv("CGO_" + name + "_ALLOW"); env != "" { 220 r, err := regexp.Compile(env) 221 if err != nil { 222 return fmt.Errorf("parsing $CGO_%s_ALLOW: %v", name, err) 223 } 224 allow = r 225 } 226 if env := os.Getenv("CGO_" + name + "_DISALLOW"); env != "" { 227 r, err := regexp.Compile(env) 228 if err != nil { 229 return fmt.Errorf("parsing $CGO_%s_DISALLOW: %v", name, err) 230 } 231 disallow = r 232 } 233 234 Args: 235 for i := 0; i < len(list); i++ { 236 arg := list[i] 237 if disallow != nil && disallow.FindString(arg) == arg { 238 goto Bad 239 } 240 if allow != nil && allow.FindString(arg) == arg { 241 continue Args 242 } 243 for _, re := range valid { 244 if re.FindString(arg) == arg { // must be complete match 245 continue Args 246 } 247 } 248 for _, x := range validNext { 249 if arg == x { 250 if i+1 < len(list) && load.SafeArg(list[i+1]) { 251 i++ 252 continue Args 253 } 254 255 // Permit -Wl,-framework -Wl,name. 256 if i+1 < len(list) && 257 strings.HasPrefix(arg, "-Wl,") && 258 strings.HasPrefix(list[i+1], "-Wl,") && 259 load.SafeArg(list[i+1][4:]) && 260 !strings.Contains(list[i+1][4:], ",") { 261 i++ 262 continue Args 263 } 264 265 if i+1 < len(list) { 266 return fmt.Errorf("invalid flag in %s: %s %s (see https://golang.org/s/invalidflag)", source, arg, list[i+1]) 267 } 268 return fmt.Errorf("invalid flag in %s: %s without argument (see https://golang.org/s/invalidflag)", source, arg) 269 } 270 } 271 Bad: 272 return fmt.Errorf("invalid flag in %s: %s", source, arg) 273 } 274 return nil 275 }