github.com/zxy12/go_duplicate_112_new@v0.0.0-20200807091221-747231827200/src/cmd/go/internal/work/security.go (about) 1 // Copyright 2018 The Go Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style 3 // license that can be found in the LICENSE file. 4 5 // Checking of compiler and linker flags. 6 // We must avoid flags like -fplugin=, which can allow 7 // arbitrary code execution during the build. 8 // Do not make changes here without carefully 9 // considering the implications. 10 // (That's why the code is isolated in a file named security.go.) 11 // 12 // Note that -Wl,foo means split foo on commas and pass to 13 // the linker, so that -Wl,-foo,bar means pass -foo bar to 14 // the linker. Similarly -Wa,foo for the assembler and so on. 15 // If any of these are permitted, the wildcard portion must 16 // disallow commas. 17 // 18 // Note also that GNU binutils accept any argument @foo 19 // as meaning "read more flags from the file foo", so we must 20 // guard against any command-line argument beginning with @, 21 // even things like "-I @foo". 22 // We use load.SafeArg (which is even more conservative) 23 // to reject these. 24 // 25 // Even worse, gcc -I@foo (one arg) turns into cc1 -I @foo (two args), 26 // so although gcc doesn't expand the @foo, cc1 will. 27 // So out of paranoia, we reject @ at the beginning of every 28 // flag argument that might be split into its own argument. 29 30 package work 31 32 import ( 33 "cmd/go/internal/load" 34 "fmt" 35 "os" 36 "regexp" 37 "strings" 38 ) 39 40 var re = regexp.MustCompile 41 42 var validCompilerFlags = []*regexp.Regexp{ 43 re(`-D([A-Za-z_].*)`), 44 re(`-F([^@\-].*)`), 45 re(`-I([^@\-].*)`), 46 re(`-O`), 47 re(`-O([^@\-].*)`), 48 re(`-W`), 49 re(`-W([^@,]+)`), // -Wall but not -Wa,-foo. 50 re(`-Wa,-mbig-obj`), 51 re(`-Wp,-D([A-Za-z_].*)`), 52 re(`-ansi`), 53 re(`-f(no-)?asynchronous-unwind-tables`), 54 re(`-f(no-)?blocks`), 55 re(`-f(no-)builtin-[a-zA-Z0-9_]*`), 56 re(`-f(no-)?common`), 57 re(`-f(no-)?constant-cfstrings`), 58 re(`-fdiagnostics-show-note-include-stack`), 59 re(`-f(no-)?eliminate-unused-debug-types`), 60 re(`-f(no-)?exceptions`), 61 re(`-f(no-)?fast-math`), 62 re(`-f(no-)?inline-functions`), 63 re(`-finput-charset=([^@\-].*)`), 64 re(`-f(no-)?fat-lto-objects`), 65 re(`-f(no-)?keep-inline-dllexport`), 66 re(`-f(no-)?lto`), 67 re(`-fmacro-backtrace-limit=(.+)`), 68 re(`-fmessage-length=(.+)`), 69 re(`-f(no-)?modules`), 70 re(`-f(no-)?objc-arc`), 71 re(`-f(no-)?objc-nonfragile-abi`), 72 re(`-f(no-)?objc-legacy-dispatch`), 73 re(`-f(no-)?omit-frame-pointer`), 74 re(`-f(no-)?openmp(-simd)?`), 75 re(`-f(no-)?permissive`), 76 re(`-f(no-)?(pic|PIC|pie|PIE)`), 77 re(`-f(no-)?plt`), 78 re(`-f(no-)?rtti`), 79 re(`-f(no-)?split-stack`), 80 re(`-f(no-)?stack-(.+)`), 81 re(`-f(no-)?strict-aliasing`), 82 re(`-f(un)signed-char`), 83 re(`-f(no-)?use-linker-plugin`), // safe if -B is not used; we don't permit -B 84 re(`-f(no-)?visibility-inlines-hidden`), 85 re(`-fsanitize=(.+)`), 86 re(`-ftemplate-depth-(.+)`), 87 re(`-fvisibility=(.+)`), 88 re(`-g([^@\-].*)?`), 89 re(`-m32`), 90 re(`-m64`), 91 re(`-m(abi|arch|cpu|fpu|tune)=([^@\-].*)`), 92 re(`-m(no-)?v?aes`), 93 re(`-marm`), 94 re(`-m(no-)?avx[0-9a-z]*`), 95 re(`-mfloat-abi=([^@\-].*)`), 96 re(`-mfpmath=[0-9a-z,+]*`), 97 re(`-m(no-)?avx[0-9a-z.]*`), 98 re(`-m(no-)?ms-bitfields`), 99 re(`-m(no-)?stack-(.+)`), 100 re(`-mmacosx-(.+)`), 101 re(`-mios-simulator-version-min=(.+)`), 102 re(`-miphoneos-version-min=(.+)`), 103 re(`-mnop-fun-dllimport`), 104 re(`-m(no-)?sse[0-9.]*`), 105 re(`-m(no-)?ssse3`), 106 re(`-mthumb(-interwork)?`), 107 re(`-mthreads`), 108 re(`-mwindows`), 109 re(`--param=ssp-buffer-size=[0-9]*`), 110 re(`-pedantic(-errors)?`), 111 re(`-pipe`), 112 re(`-pthread`), 113 re(`-?-std=([^@\-].*)`), 114 re(`-?-stdlib=([^@\-].*)`), 115 re(`--sysroot=([^@\-].*)`), 116 re(`-w`), 117 re(`-x([^@\-].*)`), 118 re(`-v`), 119 } 120 121 var validCompilerFlagsWithNextArg = []string{ 122 "-arch", 123 "-D", 124 "-I", 125 "-framework", 126 "-isysroot", 127 "-isystem", 128 "--sysroot", 129 "-target", 130 "-x", 131 } 132 133 var validLinkerFlags = []*regexp.Regexp{ 134 re(`-F([^@\-].*)`), 135 re(`-l([^@\-].*)`), 136 re(`-L([^@\-].*)`), 137 re(`-O`), 138 re(`-O([^@\-].*)`), 139 re(`-f(no-)?(pic|PIC|pie|PIE)`), 140 re(`-f(no-)?openmp(-simd)?`), 141 re(`-fsanitize=([^@\-].*)`), 142 re(`-flat_namespace`), 143 re(`-g([^@\-].*)?`), 144 re(`-headerpad_max_install_names`), 145 re(`-m(abi|arch|cpu|fpu|tune)=([^@\-].*)`), 146 re(`-mfloat-abi=([^@\-].*)`), 147 re(`-mmacosx-(.+)`), 148 re(`-mios-simulator-version-min=(.+)`), 149 re(`-miphoneos-version-min=(.+)`), 150 re(`-mthreads`), 151 re(`-mwindows`), 152 re(`-(pic|PIC|pie|PIE)`), 153 re(`-pthread`), 154 re(`-rdynamic`), 155 re(`-shared`), 156 re(`-?-static([-a-z0-9+]*)`), 157 re(`-?-stdlib=([^@\-].*)`), 158 re(`-v`), 159 160 // Note that any wildcards in -Wl need to exclude comma, 161 // since -Wl splits its argument at commas and passes 162 // them all to the linker uninterpreted. Allowing comma 163 // in a wildcard would allow tunnelling arbitrary additional 164 // linker arguments through one of these. 165 re(`-Wl,--(no-)?allow-multiple-definition`), 166 re(`-Wl,--(no-)?allow-shlib-undefined`), 167 re(`-Wl,--(no-)?as-needed`), 168 re(`-Wl,-Bdynamic`), 169 re(`-Wl,-Bstatic`), 170 re(`-WL,-O([^@,\-][^,]*)?`), 171 re(`-Wl,-d[ny]`), 172 re(`-Wl,--disable-new-dtags`), 173 re(`-Wl,-e[=,][a-zA-Z0-9]*`), 174 re(`-Wl,--enable-new-dtags`), 175 re(`-Wl,--end-group`), 176 re(`-Wl,--(no-)?export-dynamic`), 177 re(`-Wl,-framework,[^,@\-][^,]+`), 178 re(`-Wl,-headerpad_max_install_names`), 179 re(`-Wl,--no-undefined`), 180 re(`-Wl,-R([^@\-][^,@]*$)`), 181 re(`-Wl,--just-symbols[=,]([^,@\-][^,@]+)`), 182 re(`-Wl,-rpath(-link)?[=,]([^,@\-][^,]+)`), 183 re(`-Wl,-s`), 184 re(`-Wl,-search_paths_first`), 185 re(`-Wl,-sectcreate,([^,@\-][^,]+),([^,@\-][^,]+),([^,@\-][^,]+)`), 186 re(`-Wl,--start-group`), 187 re(`-Wl,-?-static`), 188 re(`-Wl,-?-subsystem,(native|windows|console|posix|xbox)`), 189 re(`-Wl,-syslibroot[=,]([^,@\-][^,]+)`), 190 re(`-Wl,-undefined[=,]([^,@\-][^,]+)`), 191 re(`-Wl,-?-unresolved-symbols=[^,]+`), 192 re(`-Wl,--(no-)?warn-([^,]+)`), 193 re(`-Wl,-z,(no)?execstack`), 194 re(`-Wl,-z,relro`), 195 196 re(`[a-zA-Z0-9_/].*\.(a|o|obj|dll|dylib|so)`), // direct linker inputs: x.o or libfoo.so (but not -foo.o or @foo.o) 197 re(`\./.*\.(a|o|obj|dll|dylib|so)`), 198 } 199 200 var validLinkerFlagsWithNextArg = []string{ 201 "-arch", 202 "-F", 203 "-l", 204 "-L", 205 "-framework", 206 "-isysroot", 207 "--sysroot", 208 "-target", 209 "-Wl,-framework", 210 "-Wl,-rpath", 211 "-Wl,-R", 212 "-Wl,--just-symbols", 213 "-Wl,-undefined", 214 } 215 216 func checkCompilerFlags(name, source string, list []string) error { 217 return checkFlags(name, source, list, validCompilerFlags, validCompilerFlagsWithNextArg) 218 } 219 220 func checkLinkerFlags(name, source string, list []string) error { 221 return checkFlags(name, source, list, validLinkerFlags, validLinkerFlagsWithNextArg) 222 } 223 224 func checkFlags(name, source string, list []string, valid []*regexp.Regexp, validNext []string) error { 225 // Let users override rules with $CGO_CFLAGS_ALLOW, $CGO_CFLAGS_DISALLOW, etc. 226 var ( 227 allow *regexp.Regexp 228 disallow *regexp.Regexp 229 ) 230 if env := os.Getenv("CGO_" + name + "_ALLOW"); env != "" { 231 r, err := regexp.Compile(env) 232 if err != nil { 233 return fmt.Errorf("parsing $CGO_%s_ALLOW: %v", name, err) 234 } 235 allow = r 236 } 237 if env := os.Getenv("CGO_" + name + "_DISALLOW"); env != "" { 238 r, err := regexp.Compile(env) 239 if err != nil { 240 return fmt.Errorf("parsing $CGO_%s_DISALLOW: %v", name, err) 241 } 242 disallow = r 243 } 244 245 Args: 246 for i := 0; i < len(list); i++ { 247 arg := list[i] 248 if disallow != nil && disallow.FindString(arg) == arg { 249 goto Bad 250 } 251 if allow != nil && allow.FindString(arg) == arg { 252 continue Args 253 } 254 for _, re := range valid { 255 if re.FindString(arg) == arg { // must be complete match 256 continue Args 257 } 258 } 259 for _, x := range validNext { 260 if arg == x { 261 if i+1 < len(list) && load.SafeArg(list[i+1]) { 262 i++ 263 continue Args 264 } 265 266 // Permit -Wl,-framework -Wl,name. 267 if i+1 < len(list) && 268 strings.HasPrefix(arg, "-Wl,") && 269 strings.HasPrefix(list[i+1], "-Wl,") && 270 load.SafeArg(list[i+1][4:]) && 271 !strings.Contains(list[i+1][4:], ",") { 272 i++ 273 continue Args 274 } 275 276 if i+1 < len(list) { 277 return fmt.Errorf("invalid flag in %s: %s %s (see https://golang.org/s/invalidflag)", source, arg, list[i+1]) 278 } 279 return fmt.Errorf("invalid flag in %s: %s without argument (see https://golang.org/s/invalidflag)", source, arg) 280 } 281 } 282 Bad: 283 return fmt.Errorf("invalid flag in %s: %s", source, arg) 284 } 285 return nil 286 }