From e2e45530c76ff8ed42f38302f57fea05208c4594 Mon Sep 17 00:00:00 2001
From: Adam Yoblick <Adam.Yoblick@microsoft.com>
Date: Wed, 16 Oct 2024 12:31:29 -0500
Subject: [PATCH] Fix various build and compliance warnings (#8031)

* fix drop retention for vsts drop upload

* Add /CETCOMPAT to linker command line

* Add /CETCOMPAT to linker command line

* Set SDL and CETCOMPAT flags explicitly

* Set SDL and CETCOMPAT flags explicitly

* Set SDL and CETCOMPAT flags explicitly

* Set SDL and CETCOMPAT flags explicitly, along with QSPECTRE

* Fix more binskim warnings
---
 Python/Product/DebuggerHelper/DebuggerHelper.vcxproj    | 3 +++
 Python/Product/DebuggerHelper/DebuggerHelperX86.vcxproj | 3 +++
 Python/Product/PyDebugAttach/PyDebugAttach.vcxproj      | 3 +++
 Python/Product/PyDebugAttach/PyDebugAttachX86.vcxproj   | 4 ++++
 Python/Product/VsPyProf/VsPyProf.vcxproj                | 3 +++
 Python/Product/VsPyProf/VsPyProfX86.vcxproj             | 3 +++
 azure-pipelines.yml                                     | 2 ++
 7 files changed, 21 insertions(+)

diff --git a/Python/Product/DebuggerHelper/DebuggerHelper.vcxproj b/Python/Product/DebuggerHelper/DebuggerHelper.vcxproj
index 10d5126ecb..7bc67a80d2 100644
--- a/Python/Product/DebuggerHelper/DebuggerHelper.vcxproj
+++ b/Python/Product/DebuggerHelper/DebuggerHelper.vcxproj
@@ -106,6 +106,7 @@
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <OptimizeReferences>false</OptimizeReferences>
       <AdditionalOptions Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">/guard:cf %(AdditionalOptions)</AdditionalOptions>
+      <CETCompat Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">true</CETCompat>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)'=='Release'">
@@ -119,6 +120,7 @@
       <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
       <FunctionLevelLinking>false</FunctionLevelLinking>
       <ControlFlowGuard Condition="'$(Configuration)|$(Platform)'=='Release|x64'">Guard</ControlFlowGuard>
+      <SDLCheck Condition="'$(Configuration)|$(Platform)'=='Release|x64'">true</SDLCheck>
     </ClCompile>
     <Link>
       <SubSystem>Console</SubSystem>
@@ -128,6 +130,7 @@
       <EnableCOMDATFolding>false</EnableCOMDATFolding>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <OptimizeReferences>false</OptimizeReferences>
+      <CETCompat Condition="'$(Configuration)|$(Platform)'=='Release|x64'">true</CETCompat>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>
diff --git a/Python/Product/DebuggerHelper/DebuggerHelperX86.vcxproj b/Python/Product/DebuggerHelper/DebuggerHelperX86.vcxproj
index a546190339..22ebe6ff9b 100644
--- a/Python/Product/DebuggerHelper/DebuggerHelperX86.vcxproj
+++ b/Python/Product/DebuggerHelper/DebuggerHelperX86.vcxproj
@@ -106,6 +106,7 @@
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <OptimizeReferences>false</OptimizeReferences>
       <AdditionalOptions Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">/guard:cf %(AdditionalOptions)</AdditionalOptions>
+      <CETCompat Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">true</CETCompat>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)'=='Release'">
@@ -119,6 +120,7 @@
       <FunctionLevelLinking>false</FunctionLevelLinking>
       <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
       <ControlFlowGuard Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">Guard</ControlFlowGuard>
+      <SDLCheck Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">true</SDLCheck>
     </ClCompile>
     <Link>
       <SubSystem>Windows</SubSystem>
@@ -128,6 +130,7 @@
       <EnableCOMDATFolding>false</EnableCOMDATFolding>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
       <OptimizeReferences>false</OptimizeReferences>
+      <CETCompat Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">true</CETCompat>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>
diff --git a/Python/Product/PyDebugAttach/PyDebugAttach.vcxproj b/Python/Product/PyDebugAttach/PyDebugAttach.vcxproj
index e6f815a9bc..d86ef39b53 100644
--- a/Python/Product/PyDebugAttach/PyDebugAttach.vcxproj
+++ b/Python/Product/PyDebugAttach/PyDebugAttach.vcxproj
@@ -95,6 +95,7 @@
       <OutputFile>$(TargetPath)</OutputFile>
       <AdditionalDependencies>ws2_32.lib;psapi.lib;kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies)</AdditionalDependencies>
       <AdditionalOptions Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">/guard:cf %(AdditionalOptions)</AdditionalOptions>
+      <CETCompat Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">true</CETCompat>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)'=='Release'">
@@ -103,12 +104,14 @@
       <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
       <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
       <ControlFlowGuard Condition="'$(Configuration)|$(Platform)'=='Release|x64'">Guard</ControlFlowGuard>
+      <SDLCheck Condition="'$(Configuration)|$(Platform)'=='Release|x64'">true</SDLCheck>
     </ClCompile>
     <Link>
       <SubSystem>Windows</SubSystem>
       <OutputFile>$(TargetPath)</OutputFile>
       <AdditionalDependencies>ws2_32.lib;psapi.lib;kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies)</AdditionalDependencies>
       <AdditionalOptions>/debugtype:cv,fixup /guard:cf %(AdditionalOptions)</AdditionalOptions>
+      <CETCompat Condition="'$(Configuration)|$(Platform)'=='Release|x64'">true</CETCompat>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>
diff --git a/Python/Product/PyDebugAttach/PyDebugAttachX86.vcxproj b/Python/Product/PyDebugAttach/PyDebugAttachX86.vcxproj
index a6ed627f15..d4686ce24c 100644
--- a/Python/Product/PyDebugAttach/PyDebugAttachX86.vcxproj
+++ b/Python/Product/PyDebugAttach/PyDebugAttachX86.vcxproj
@@ -63,6 +63,7 @@
   </PropertyGroup>
   <PropertyGroup Label="Configuration" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
     <PlatformToolset>v143</PlatformToolset>
+    <SpectreMitigation>Spectre</SpectreMitigation>
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
   <ImportGroup Label="ExtensionSettings">
@@ -94,6 +95,7 @@
       <OutputFile>$(TargetPath)</OutputFile>
       <AdditionalDependencies>ws2_32.lib;psapi.lib;kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies)</AdditionalDependencies>
       <AdditionalOptions Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">/guard:cf %(AdditionalOptions)</AdditionalOptions>
+      <CETCompat Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">true</CETCompat>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)'=='Release'">
@@ -101,12 +103,14 @@
       <PreprocessorDefinitions>_WINDOWS;_USRDLL;PYDEBUGATTACH_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
       <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+      <SDLCheck Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">true</SDLCheck>
     </ClCompile>
     <Link>
       <SubSystem>Windows</SubSystem>
       <OutputFile>$(TargetPath)</OutputFile>
       <AdditionalDependencies>ws2_32.lib;psapi.lib;kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies)</AdditionalDependencies>
       <AdditionalOptions>/debugtype:cv,fixup /guard:cf %(AdditionalOptions)</AdditionalOptions>
+      <CETCompat Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">true</CETCompat>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>
diff --git a/Python/Product/VsPyProf/VsPyProf.vcxproj b/Python/Product/VsPyProf/VsPyProf.vcxproj
index 706e001965..53417bf32c 100644
--- a/Python/Product/VsPyProf/VsPyProf.vcxproj
+++ b/Python/Product/VsPyProf/VsPyProf.vcxproj
@@ -92,6 +92,7 @@
       <SubSystem>Windows</SubSystem>
       <OutputFile>$(TargetPath)</OutputFile>
       <AdditionalOptions Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">/guard:cf %(AdditionalOptions)</AdditionalOptions>
+      <CETCompat Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">true</CETCompat>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)'=='Release'">
@@ -99,11 +100,13 @@
       <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
       <PreprocessorDefinitions>_WINDOWS;_USRDLL;VSPYPROF_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <ControlFlowGuard Condition="'$(Configuration)|$(Platform)'=='Release|x64'">Guard</ControlFlowGuard>
+      <SDLCheck Condition="'$(Configuration)|$(Platform)'=='Release|x64'">true</SDLCheck>
     </ClCompile>
     <Link>
       <SubSystem>Windows</SubSystem>
       <OutputFile>$(TargetPath)</OutputFile>
       <AdditionalOptions>/debugtype:cv,fixup /guard:cf %(AdditionalOptions)</AdditionalOptions>
+      <CETCompat Condition="'$(Configuration)|$(Platform)'=='Release|x64'">true</CETCompat>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>
diff --git a/Python/Product/VsPyProf/VsPyProfX86.vcxproj b/Python/Product/VsPyProf/VsPyProfX86.vcxproj
index 902ad2f7d7..53191bfdcd 100644
--- a/Python/Product/VsPyProf/VsPyProfX86.vcxproj
+++ b/Python/Product/VsPyProf/VsPyProfX86.vcxproj
@@ -92,6 +92,7 @@
       <SubSystem>Windows</SubSystem>
       <OutputFile>$(TargetPath)</OutputFile>
       <AdditionalOptions Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">/guard:cf %(AdditionalOptions)</AdditionalOptions>
+      <CETCompat Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">true</CETCompat>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)'=='Release'">
@@ -99,11 +100,13 @@
       <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
       <PreprocessorDefinitions>_WINDOWS;_USRDLL;VSPYPROF_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <ControlFlowGuard Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">Guard</ControlFlowGuard>
+      <SDLCheck Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">true</SDLCheck>
     </ClCompile>
     <Link>
       <SubSystem>Windows</SubSystem>
       <OutputFile>$(TargetPath)</OutputFile>
       <AdditionalOptions>/debugtype:cv,fixup /guard:cf %(AdditionalOptions)</AdditionalOptions>
+      <CETCompat Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">true</CETCompat>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>
diff --git a/azure-pipelines.yml b/azure-pipelines.yml
index 8f5af333b9..1226e8b88d 100644
--- a/azure-pipelines.yml
+++ b/azure-pipelines.yml
@@ -185,6 +185,7 @@ extends:
           - template: Build/templates/create_vs_bootstrapper.yml@self
 
           # Upload vsts drop used by Visual Studio insertions
+          # For more info, see https://eng.ms/docs/cloud-ai-platform/devdiv/one-engineering-system-1es/1es-docs/1es-pipeline-templates/features/outputs/microbuild-vsts-drop
           - task: 1ES.MicroBuildVstsDrop@1
             displayName: 'Upload vsts drop'
             inputs:
@@ -192,6 +193,7 @@ extends:
               dropServiceUri: 'https://devdiv.artifacts.visualstudio.com/DefaultCollection'
               vsDropServiceUri: 'https://vsdrop.corp.microsoft.com/file/v1'
               accessToken: '$(System.AccessToken)'
+              dropRetentionDays: 183
 
           # publish symbols
           - template: /Build/templates/publish_symbols.yml@self