[RULE REQUEST] Enable Additional Security Checks

[eddynaka]

Rule Proposal: Enable Additional Security Checks

Rule metadata

• Id: BA2026
• Name: EnableAdditionalSecurityChecks
• Failure level: Warning

Rule descriptions

• Short:
• Full: /sdl enables a superset of the baseline security checks provided by /GS and overrides /GS-. By default, /sdl is off. /sdl- disables the additional security checks.

Platform & applicability

• Platform: Windows
• Applicable to: Native binaries with pdb
• Not applicable to:

User-facing strings

• Fail: '{0}' does not enable the recommended Security Development Lifecycle (SDL) checks. To Enable the recommended Security Development Lifecycle (SDL) checks pass /sdl on the cl.exe command-line.
• Pass: '{0}' enables the recommended Security Development Lifecycle (SDL) checks. These checks change security-relevant warnings into errors, and set additional secure code-generation features.
• [Other]:

Links/Additional Information

https://docs.microsoft.com/en-us/cpp/build/reference/sdl-enable-additional-security-checks?view=msvc-160
https://www.microsoft.com/security/blog/2012/06/06/warnings-sdl-and-improving-uninitialized-variable-detection/

Implementation Notes

How to resolve

/sdl