From 1b2bb4706e5aa432eca930543d34befe97e75eea Mon Sep 17 00:00:00 2001
From: Ofek <ofekshilon@gmail.com>
Date: Thu, 28 May 2026 20:45:19 +0300
Subject: [PATCH] Fix #8740: Remove outdated security check (#8752)

---
 lib/base-compiler.ts        | 18 ------------------
 lib/compilers/coccinelle.ts |  6 +-----
 test/base-compiler-tests.ts | 34 +---------------------------------
 3 files changed, 2 insertions(+), 56 deletions(-)

diff --git a/lib/base-compiler.ts b/lib/base-compiler.ts
index c32e0aa1c..2f9474247 100644
--- a/lib/base-compiler.ts
+++ b/lib/base-compiler.ts
@@ -3106,8 +3106,6 @@ export class BaseCompiler {
     ) {
         const optionsError = this.checkOptions(options);
         if (optionsError) throw optionsError;
-        const sourceError = this.checkSource(source);
-        if (sourceError) throw sourceError;
 
         const libsAndOptions = {libraries, options};
         if (this.tryAutodetectLibraries(libsAndOptions)) {
@@ -3746,22 +3744,6 @@ but nothing was dumped. Possible causes are:
         return null;
     }
 
-    // This check for arbitrary user-controlled preprocessor inclusions
-    // can be circumvented in more than one way. The goal here is to respond
-    // to simple attempts with a clear diagnostic; the service still needs to
-    // assume that malicious actors can make the compiler open arbitrary files.
-    checkSource(source: string) {
-        const re = /^\s*#\s*i(nclude|mport)(_next)?\s+["<]((\.{1,2}|\/)[^">]*)[">]/;
-        const failed: string[] = [];
-        for (const [index, line] of utils.splitLines(source).entries()) {
-            if (re.test(line)) {
-                failed.push(`<stdin>:${index + 1}:1: no absolute or relative includes please`);
-            }
-        }
-        if (failed.length > 0) return failed.join('\n');
-        return null;
-    }
-
     protected getArgumentParserClass(): typeof BaseParser {
         const exe = this.compiler.exe.toLowerCase();
         const exeFilename = path.basename(exe);
diff --git a/lib/compilers/coccinelle.ts b/lib/compilers/coccinelle.ts
index e932cff3b..7149a0c1c 100644
--- a/lib/compilers/coccinelle.ts
+++ b/lib/compilers/coccinelle.ts
@@ -211,11 +211,7 @@ export class CoccinelleCCompiler extends BaseCompiler {
         spfile.write(pFileContents);
         spfile.close();
 
-        // check that the SmPL source does not #include anything, via CE rules
-        let cocciSourceError = this.checkSource(pFileContents);
-        if (cocciSourceError) throw cocciSourceError;
-        // use own rules, too
-        cocciSourceError = this.checkCocciSource(pFileContents);
+        const cocciSourceError = this.checkCocciSource(pFileContents);
         if (cocciSourceError) throw cocciSourceError;
 
         const result = await this.exec(compiler, options, execOptions);
diff --git a/test/base-compiler-tests.ts b/test/base-compiler-tests.ts
index b1eaf0c84..2d9987365 100644
--- a/test/base-compiler-tests.ts
+++ b/test/base-compiler-tests.ts
@@ -37,12 +37,7 @@ import {splitArguments} from '../shared/common-utils.js';
 import {CompilerOverrideType, ConfiguredOverrides} from '../types/compilation/compiler-overrides.interfaces.js';
 import {CompilerInfo} from '../types/compiler.interfaces.js';
 import {SelectedLibraryVersion} from '../types/libraries/libraries.interfaces.js';
-import {
-    makeCompilationEnvironment,
-    makeFakeCompilerInfo,
-    makeFakeParseFiltersAndOutputOptions,
-    shouldExist,
-} from './utils.js';
+import {makeCompilationEnvironment, makeFakeCompilerInfo, makeFakeParseFiltersAndOutputOptions} from './utils.js';
 
 const languages = {
     'c++': {id: 'c++'},
@@ -74,34 +69,7 @@ describe('Basic compiler invariants', () => {
         expect(compiler.optOutputRequested(['please', 'recognize', '-fsave-optimization-record'])).toBe(true);
         expect(compiler.optOutputRequested(['please', "don't", 'recognize'])).toBe(false);
     });
-    it('should allow comments next to includes (Bug #874)', () => {
-        expect(compiler.checkSource('#include <cmath> // std::(sin, cos, ...)')).toBeNull();
-        const badSource = compiler.checkSource('#include </dev/null..> //Muehehehe');
-        if (shouldExist(badSource)) {
-            expect(badSource).toEqual('<stdin>:1:1: no absolute or relative includes please');
-        }
-    });
-    it('should not warn of path-likes outside C++ includes (Bug #3045)', () => {
-        function testIncludeG(text: string) {
-            expect(compiler.checkSource(text)).toBeNull();
-        }
 
-        testIncludeG('#include <iostream>');
-        testIncludeG('#include <iostream>  // <..>');
-        testIncludeG('#include <type_traits> // for std::is_same_v<...>');
-        testIncludeG('#include <ranges>      // for std::ranges::range<...> and std::ranges::range_type_v<...>');
-        testIncludeG('#include <https://godbolt.com> // /home/');
-    });
-    it('should not allow path C++ includes', () => {
-        function testIncludeNotG(text: string) {
-            expect(compiler.checkSource(text)).toEqual('<stdin>:1:1: no absolute or relative includes please');
-        }
-
-        testIncludeNotG('#include <./.bashrc>');
-        testIncludeNotG('#include </dev/null>  // <..>');
-        testIncludeNotG('#include <../fish.config> // for std::is_same_v<...>');
-        testIncludeNotG('#include <./>      // for std::ranges::range<...> and std::ranges::range_type_v<...>');
-    });
     it('should skip version check if forced to', async () => {
         const newConfig: Partial<CompilerInfo> = {...info, explicitVersion: '123'};
         const forcedVersionCompiler = new BaseCompiler(newConfig as CompilerInfo, ce);