Merge pull request #4 from gms1/feature/hardening

Author: gms1

binding.gyp

@@ -11,6 +11,7 @@
       "xcode_settings": {
         "CLANG_CXX_LIBRARY": "libc++",
         "MACOSX_DEPLOYMENT_TARGET": "10.7",
+        "OTHER_CFLAGS": [ "-fstack-protector-strong" ]
       },
       "include_dirs": [
         "<!@(node -p \"require('node-addon-api').include\")"],
@@ -39,15 +40,58 @@
               "deps/sqlite3.gyp:sqlite3"
             ]
         }
-        ]
+        ],
+        # Linux hardening flags (apply to all builds)
+        ["OS=='linux'", {
+          "cflags+": [
+            "-fstack-protector-strong",
+            "-fPIC"
+          ],
+          "ldflags+": [ "-Wl,-z,relro,-z,now" ]
+        }],
+        # Windows hardening flags (apply to all builds)
+        ["OS=='win'", {
+          "msvs_settings": {
+            "VCCLCompilerTool": {
+              "ExceptionHandling": 1,
+              "BufferSecurityCheck": "true",
+              "ControlFlowGuard": "Guard"
+            },
+            "VCLinkerTool": {
+              "AdditionalOptions": [ "/DYNAMICBASE", "/NXCOMPAT" ]
+            }
+          }
+        }]
       ],
       "sources": [
         "src/backup.cc",
         "src/database.cc",
         "src/node_sqlite3.cc",
         "src/statement.cc"
       ],
-      "defines": [ "NAPI_VERSION=<(napi_build_version)" ]
+      "defines": [ "NAPI_VERSION=<(napi_build_version)" ],
+      # Release-specific hardening flags
+      "configurations": {
+        "Release": {
+          "conditions": [
+            # _FORTIFY_SOURCE applies to all Linux architectures
+            ["OS=='linux'", {
+              "defines+": [ "_FORTIFY_SOURCE=2" ]
+            }],
+            # Control Flow Protection only for x86_64 (Intel CET)
+            ["OS=='linux' and target_arch=='x64'", {
+              "cflags+": [ "-fcf-protection=full" ]
+            }],
+            ["OS=='win'", {
+              "msvs_settings": {
+                "VCCLCompilerTool": {
+                  "AdditionalOptions": [ "/sdl" ]
+                }
+              }
+            }]
+          ]
+        }
+      }
     }
   ]
 }