Skip to content

Commit d855c81

Browse files
gms1gms1
committed
memory bank update
1 parent 6d09418 commit d855c81

4 files changed

Lines changed: 159 additions & 19 deletions

File tree

‎memory-bank/activeContext.md‎

Lines changed: 12 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -2,36 +2,32 @@
22

33
## Current Status
44

5-
**Last Updated**: 2026-03-28
5+
**Last Updated**: 2026-03-29
66

77
## Current Work
88

9-
### Promisification Implementation
9+
### Security Hardening Documentation
1010

1111
**Status**: ✅ COMPLETE
1212

13-
Promise-based wrapper classes are implemented in [`lib/promise/`](../lib/promise/):
13+
Documented the security hardening implementation in [`binding.gyp`](../binding.gyp):
1414

15-
- [`SqliteDatabase`](../lib/promise/database.js) - Promise wrapper for `Database`
16-
- [`SqliteStatement`](../lib/promise/statement.js) - Promise wrapper for `Statement`
17-
- [`SqliteBackup`](../lib/promise/backup.js) - Promise wrapper for `Backup`
18-
- [`index.js`](../lib/promise/index.js) - Module exports
19-
20-
**Features Implemented**:
21-
- Static factory method `SqliteDatabase.open(filename, mode)`
22-
- All async methods return Promises
23-
- Transaction support: `beginTransaction()`, `commitTransaction()`, `rollbackTransaction()`
24-
- `each()` method with row callback pattern
25-
- Event emitter support preserved
15+
- Added comprehensive "Security Hardening" section to [`build-system.md`](build-system.md)
16+
- Documented platform-specific hardening flags:
17+
- **Linux**: `-fstack-protector-strong`, `-fPIC`, RELRO, `_FORTIFY_SOURCE=2`, CET
18+
- **Windows**: BufferSecurityCheck, ControlFlowGuard, ASLR, DEP, /sdl
19+
- **macOS**: `-fstack-protector-strong`, libc++
20+
- Added hardening decision entry to [`decisionLog.md`](decisionLog.md)
21+
- Updated [`progress.md`](progress.md) with completed work
2622

2723
## Pending Tasks
2824

2925
No active tasks currently assigned.
3026

3127
## Recent Changes
3228

33-
- Memory-bank structure created with UMB workflow support
34-
- Promisification implementation verified as complete
29+
- Security hardening documentation added to memory bank
30+
- Memory-bank structure updated with hardening details
3531

3632
## Open Questions
3733

‎memory-bank/build-system.md‎

Lines changed: 91 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,7 @@ Enables:
9797
- `DEBUG` and `_DEBUG` preprocessor macros
9898
- Debug symbols (`GCC_GENERATE_DEBUGGING_SYMBOLS: YES`)
9999
- No optimizations (`GCC_OPTIMIZATION_LEVEL: 0`)
100-
- `ASSERT_STATUS()` macro checks (src/macros.h:140)
100+
- `ASSERT_STATUS()` macro checks (src/macros.h)
101101

102102
### Release Configuration (Default)
103103

@@ -114,9 +114,20 @@ Enables:
114114
node-gyp rebuild --sqlite=/path/to/sqlite --sqlite_libname=sqlite3
115115
```
116116

117-
### Specifying NAPI Version
117+
### NAPI Version
118118

119-
Prebuilt binaries are available for NAPI versions 3 and 6 (see `package.json` binary.napi_versions).
119+
The `NAPI_VERSION` define is set via `napi_build_version` variable in binding.gyp:
120+
121+
```python
122+
"defines": [ "NAPI_VERSION=<(napi_build_version)" ]
123+
```
124+
125+
**How it works**:
126+
- The `napi_build_version` variable is automatically set by node-gyp based on the target Node.js version
127+
- For local builds, it's stored in `build/config.gypi` (e.g., `"napi_build_version": "9"`)
128+
- For prebuilds, the `prebuild` package passes it via `--napi_build_version=<version>` flag
129+
130+
**Prebuilt binaries**: Available for NAPI versions 3 and 6 (see `package.json` `binary.napi_versions`).
120131

121132
## Assert Control
122133

@@ -172,6 +183,82 @@ yarn upload # Upload to GitHub releases
172183
- NAPI versions: 3, 6
173184
- Platforms: Linux, macOS, Windows (see prebuild configuration)
174185

186+
## Security Hardening
187+
188+
The build system includes platform-specific security hardening flags to protect against common vulnerability classes.
189+
190+
### Linux Hardening
191+
192+
Applied to all Linux builds (see `binding.gyp`):
193+
194+
| Flag | Purpose |
195+
|----------------------------|--------------------------------------------------------------------------------|
196+
| `-fstack-protector-strong` | Stack overflow protection - inserts canaries into functions with local buffers |
197+
| `-fPIC` | Position Independent Code - enables ASLR (Address Space Layout Randomization) |
198+
199+
Linker flags:
200+
201+
| Flag | Purpose |
202+
|----------------|--------------------------------------------------------------------------------------|
203+
| `-Wl,-z,relro` | Read-Only Relocations - makes some ELF sections read-only after load |
204+
| `-Wl,-z,now` | Immediate binding - resolves all symbols at load time, prevents lazy binding attacks |
205+
206+
Release-only hardening:
207+
208+
| Flag | Purpose | Scope |
209+
|------------------------|-------------------------------------------------------------------|-------------------|
210+
| `_FORTIFY_SOURCE=2` | Source-level buffer overflow detection | All architectures |
211+
| `-fcf-protection=full` | Intel CET (Control Flow Guard) - protects against ROP/JOP attacks | x86_64 only |
212+
213+
### Windows Hardening
214+
215+
Applied to all Windows builds (see `binding.gyp`):
216+
217+
**Compiler settings:**
218+
219+
| Setting | Purpose |
220+
|-------------------------------|------------------------------------------------------|
221+
| `ExceptionHandling: 1` | C++ exception handling support |
222+
| `BufferSecurityCheck: "true"` | Stack buffer overrun detection (/GS) |
223+
| `ControlFlowGuard: "Guard"` | Control Flow Guard - validates indirect call targets |
224+
225+
**Linker settings:**
226+
227+
| Setting | Purpose |
228+
|----------------|----------------------------------------------------------------------|
229+
| `/DYNAMICBASE` | ASLR - randomizes base address at load time |
230+
| `/NXCOMPAT` | DEP (Data Execution Prevention) - marks stack/heap as non-executable |
231+
232+
Release-only hardening:
233+
234+
| Setting | Purpose |
235+
|---------|-----------------------------------------|
236+
| `/sdl` | Additional security checks and warnings |
237+
238+
### macOS Hardening
239+
240+
Applied to all macOS builds (see `binding.gyp`):
241+
242+
| Flag | Purpose |
243+
|------------------------------------|---------------------------------|
244+
| `-fstack-protector-strong` | Stack overflow protection |
245+
| `CLANG_CXX_LIBRARY: "libc++"` | Use modern C++ standard library |
246+
| `MACOSX_DEPLOYMENT_TARGET: "10.7"` | Minimum deployment target |
247+
248+
### Hardening Summary
249+
250+
| Platform | Stack Protection | ASLR | Control Flow | Buffer Checks |
251+
|----------|----------------------------------|-----------------------|--------------------------|---------------------------|
252+
| Linux | Yes (`-fstack-protector-strong`) | Yes (`-fPIC` + RELRO) | Yes (CET on x86_64) | Yes (`_FORTIFY_SOURCE=2`) |
253+
| Windows | Yes (`BufferSecurityCheck`) | Yes (`/DYNAMICBASE`) | Yes (`ControlFlowGuard`) | Yes (`/sdl`) |
254+
| macOS | Yes (`-fstack-protector-strong`) | Yes (default) | No | No |
255+
256+
### References
257+
258+
- [OWASP Hardening Guide](https://owasp.org/www-project-web-security-testing-guide/)
259+
- [GCC Security Features](https://gcc.gnu.org/onlinedocs/gcc/Code-Gen-Options.html)
260+
- [MSVC Security Features](https://docs.microsoft.com/en-us/cpp/build/reference/security-best-practices)
261+
175262
## Troubleshooting
176263

177264
### Build Fails
@@ -196,3 +283,4 @@ yarn upload # Upload to GitHub releases
196283

197284
- [Project Overview](project-overview.md) - Architecture and components
198285
- [Development Workflow](development.md) - Testing and contributing
286+
- [Decision Log](decisionLog.md) - Technical decisions including hardening rationale

‎memory-bank/decisionLog.md‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,54 @@
22

33
## Technical Decisions
44

5+
### 2026-03-29: Security Hardening Implementation
6+
7+
**Decision**: Implement platform-specific security hardening flags in binding.gyp
8+
9+
**Rationale**:
10+
- Native addons are potential attack vectors in Node.js applications
11+
- Security hardening protects against common vulnerability classes:
12+
- Buffer overflow attacks
13+
- Control flow hijacking (ROP/JOP)
14+
- Stack smashing attacks
15+
- Memory corruption exploits
16+
- Modern compilers and linkers provide built-in security features
17+
- Minimal performance impact in Release builds
18+
19+
**Implementation**:
20+
21+
**Linux (all builds)**:
22+
- `-fstack-protector-strong` - Stack canaries for functions with local buffers
23+
- `-fPIC` - Position Independent Code for ASLR
24+
- `-Wl,-z,relro,-z,now` - RELRO and immediate binding
25+
26+
**Linux (Release only)**:
27+
- `_FORTIFY_SOURCE=2` - Source-level buffer overflow detection
28+
- `-fcf-protection=full` - Intel CET (x86_64 only)
29+
30+
**Windows (all builds)**:
31+
- `BufferSecurityCheck` - Stack buffer overrun detection
32+
- `ControlFlowGuard` - Control Flow Guard
33+
- `/DYNAMICBASE` - ASLR support
34+
- `/NXCOMPAT` - DEP support
35+
36+
**Windows (Release only)**:
37+
- `/sdl` - Additional security checks
38+
39+
**macOS (all builds)**:
40+
- `-fstack-protector-strong` - Stack protection
41+
- `libc++` - Modern C++ standard library
42+
43+
**Files Changed**:
44+
- `binding.gyp`: Added hardening flags for all platforms
45+
46+
**References**:
47+
- [OWASP Hardening](https://owasp.org/www-project-web-security-testing-guide/)
48+
- [GCC Security Features](https://gcc.gnu.org/onlinedocs/gcc/Code-Gen-Options.html)
49+
- [MSVC Security Features](https://docs.microsoft.com/en-us/cpp/build/reference/security-best-practices)
50+
51+
---
52+
553
### 2026-03-29: NAPI Exception Handling
654

755
**Decision**: Use `node_addon_api_except` instead of `NAPI_DISABLE_CPP_EXCEPTIONS=1`

‎memory-bank/progress.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,14 @@
22

33
## 2026-03-29
44

5+
### Security Hardening Documentation
6+
- Added comprehensive security hardening section to `build-system.md`
7+
- Documented Linux hardening flags: `-fstack-protector-strong`, `-fPIC`, RELRO, `_FORTIFY_SOURCE=2`, CET
8+
- Documented Windows hardening: BufferSecurityCheck, ControlFlowGuard, ASLR, DEP, /sdl
9+
- Documented macOS hardening: `-fstack-protector-strong`, libc++
10+
- Added hardening decision entry to `decisionLog.md`
11+
- Created hardening summary table comparing all platforms
12+
513
### Memory Bank Update
614
- Removed `NAPI_DISABLE_CPP_EXCEPTIONS` from documentation (commit 48e95e8a0d32277449c269b41fba6419acb21418)
715
- Updated `build-system.md` and `project-overview.md` to reflect current binding.gyp configuration

0 commit comments

Comments
 (0)