mirrors/compiler-explorer
2
0
Fork 0
mirror of https://github.com/compiler-explorer/compiler-explorer.git synced 2026-07-16 18:37:07 -04:00
Code Issues Packages Projects Releases Wiki Activity

Fix #8740: Remove outdated security check (#8752)

Browse Source
This commit is contained in:
Ofek
2026-05-28 20:45:19 +03:00
committed by GitHub
parent bdcd800e7d
commit 1b2bb4706e
3 changed files with 2 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
lib/base-compiler.ts
View File

@@ -3106,8 +3106,6 @@ export class BaseCompiler {
) {
const optionsError = this.checkOptions(options);
if (optionsError) throw optionsError;
const sourceError = this.checkSource(source);
if (sourceError) throw sourceError;
const libsAndOptions = {libraries, options};
if (this.tryAutodetectLibraries(libsAndOptions)) {
@@ -3746,22 +3744,6 @@ but nothing was dumped. Possible causes are:
return null;
}
// This check for arbitrary user-controlled preprocessor inclusions
// can be circumvented in more than one way. The goal here is to respond
// to simple attempts with a clear diagnostic; the service still needs to
// assume that malicious actors can make the compiler open arbitrary files.
checkSource(source: string) {
const re = /^\s*#\s*i(nclude|mport)(_next)?\s+["<]((\.{1,2}|\/)[^">]*)[">]/;
const failed: string[] = [];
for (const [index, line] of utils.splitLines(source).entries()) {
if (re.test(line)) {
failed.push(`<stdin>:${index + 1}:1: no absolute or relative includes please`);
}
}
if (failed.length > 0) return failed.join('\n');
return null;
}
protected getArgumentParserClass(): typeof BaseParser {
const exe = this.compiler.exe.toLowerCase();
const exeFilename = path.basename(exe);

6
lib/compilers/coccinelle.ts
View File

@@ -211,11 +211,7 @@ export class CoccinelleCCompiler extends BaseCompiler {
spfile.write(pFileContents);
spfile.close();
// check that the SmPL source does not #include anything, via CE rules
let cocciSourceError = this.checkSource(pFileContents);
if (cocciSourceError) throw cocciSourceError;
// use own rules, too
cocciSourceError = this.checkCocciSource(pFileContents);
const cocciSourceError = this.checkCocciSource(pFileContents);
if (cocciSourceError) throw cocciSourceError;
const result = await this.exec(compiler, options, execOptions);

34
test/base-compiler-tests.ts
View File

@@ -37,12 +37,7 @@ import {splitArguments} from '../shared/common-utils.js';
import {CompilerOverrideType, ConfiguredOverrides} from '../types/compilation/compiler-overrides.interfaces.js';
import {CompilerInfo} from '../types/compiler.interfaces.js';
import {SelectedLibraryVersion} from '../types/libraries/libraries.interfaces.js';
import {
makeCompilationEnvironment,
makeFakeCompilerInfo,
makeFakeParseFiltersAndOutputOptions,
shouldExist,
} from './utils.js';
import {makeCompilationEnvironment, makeFakeCompilerInfo, makeFakeParseFiltersAndOutputOptions} from './utils.js';
const languages = {
'c++': {id: 'c++'},
@@ -74,34 +69,7 @@ describe('Basic compiler invariants', () => {
expect(compiler.optOutputRequested(['please', 'recognize', '-fsave-optimization-record'])).toBe(true);
expect(compiler.optOutputRequested(['please', "don't", 'recognize'])).toBe(false);
});
it('should allow comments next to includes (Bug #874)', () => {
expect(compiler.checkSource('#include <cmath> // std::(sin, cos, ...)')).toBeNull();
const badSource = compiler.checkSource('#include </dev/null..> //Muehehehe');
if (shouldExist(badSource)) {
expect(badSource).toEqual('<stdin>:1:1: no absolute or relative includes please');
}
});
it('should not warn of path-likes outside C++ includes (Bug #3045)', () => {
function testIncludeG(text: string) {
expect(compiler.checkSource(text)).toBeNull();
}
testIncludeG('#include <iostream>');
testIncludeG('#include <iostream> // <..>');
testIncludeG('#include <type_traits> // for std::is_same_v<...>');
testIncludeG('#include <ranges> // for std::ranges::range<...> and std::ranges::range_type_v<...>');
testIncludeG('#include <https://godbolt.com> // /home/');
});
it('should not allow path C++ includes', () => {
function testIncludeNotG(text: string) {
expect(compiler.checkSource(text)).toEqual('<stdin>:1:1: no absolute or relative includes please');
}
testIncludeNotG('#include <./.bashrc>');
testIncludeNotG('#include </dev/null> // <..>');
testIncludeNotG('#include <../fish.config> // for std::is_same_v<...>');
testIncludeNotG('#include <./> // for std::ranges::range<...> and std::ranges::range_type_v<...>');
});
it('should skip version check if forced to', async () => {
const newConfig: Partial<CompilerInfo> = {...info, explicitVersion: '123'};
const forcedVersionCompiler = new BaseCompiler(newConfig as CompilerInfo, ce);