Sanitize IDL text written into generated comments and strings

[martinweismann]

Summary

ACT copied several IDL values verbatim into generated source files. A crafted IDL could close the surrounding comment or string literal and inject code into the generated bindings and implementation stubs. This is a potential code injection vulnerability for anyone who generates code from an IDL they don't fully control.

Changes

• License headers: the copyright attribute and the <license> lines are now sanitized for each header comment style before they are written:

  • C-style (/* */, used for C, C++, C#, Go, Node, Java and JavaScript):
    • */ and /* are broken up.
    • Java unicode escapes such as \u002a/ are neutralized.
    • A trailing backslash or ??/ trigraph is neutralized, so C/C++ line splicing can't assemble */ across lines.
  • Pascal ((* *)): *) and (* are broken up.
  • Python ('''): backslashes and single quotes are escaped.
  • CMake (#[[ ]]): ]] is broken up.
  • All styles: control characters are replaced with spaces.

  ACT logs a warning once per affected value. Existing IDLs keep working, and headers whose text needs no sanitizing are byte-for-byte unchanged.

• Descriptions: method, class, function type, parameter, error, enum and enum option descriptions that could terminate the comment they are written into are now rejected. This covers */, /*, *), (*, Java unicode escapes, trailing backslashes and control characters.

  • The allowed character sets include * and /, so these sequences were previously accepted.
  • Parameter descriptions were never validated, because the method check tested the method description instead. Function type parameter, enum and enum option descriptions had no validation at all.

• Escaping at write time: function type descriptions are escaped before being written into a Python string literal, and descriptions written into Javadoc comments are sanitized.

• Tests: new unit tests in Source/languagewriter_test.go and Source/componentdefinition_test.go.

• Example build image: Build/Dockerfile now pins emsdk to 4.0.21 instead of latest. The example build failed independently of this change: Emscripten 4.0.22 and later require Python 3.10, and the CentOS 8 image only provides Python 3.9.

Testing

• GO111MODULE=off go test -vet=off . in Source passes. -vet=off is needed because go vet already fails on existing int-to-string conversions in componentdiff.go.
• I regenerated all 22 example IDLs with the old and the new binary:
  • Each IDL succeeds or fails the same way with both.
  • All 407 generated files are identical apart from GUIDs that ACT randomizes on every run.
  • No example triggers a warning.
• I also ran crafted IDLs through both binaries:
  • Old binary: code injected through the copyright, split license lines, method descriptions and enum descriptions compiles as real C++. The injected Python assignment is real code, and the Java header contains a raw \u002a/.
  • New binary: the header payloads are neutralized, the generated C++ headers compile cleanly with -Wall -Werror, and the Python bindings contain no injected code. The description payloads are rejected with a validation error.