false positive BA2004:Warning_NativeWithInsecureStaticLibraryCompilands for managed C++ (C++/CLI) [w/repro]

[mababey]

We have some managed C++ DLLs flagged by BinSkim for BA2004, specifically for NativeWithInsecureStaticLibraryCompilands, even with /ZH:SHA_256 applied. Checking the binaries with cvtdump -sf, you can see the correct hashes for the native code, but references to managed assemblies with no hash details.

BA2004ManagedCppRepro.zip

Repro:

• Open attached solution BA2004ManagedCppRepro in VS2022.
• Build Release | x64.
• Run binskim analyze x64\Release\BA2004ManagedCppRepro.dll.

SARIF will report:

{
  "ruleId": "BA2004",
  "ruleIndex": 0,
  "message": {
    "id": "Warning_NativeWithInsecureStaticLibraryCompilands",
    "arguments": [
      "BA2004ManagedCppRepro.dll",
      "Microsoft (R) Optimizing Compiler : cxx : 19.43.34810.0 : [directly linked] [No hash value present] (Dummy.obj)\r\n"
    ]
  }
}

You can check cvdump -sf x64\Release\BA2004ManagedCppRepro.dll:

** Module: "[TRUNCATED]\BA2004ManagedCppRepro\x64\Release\Dummy.obj"

     0 C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\.NETFramework\v4.7.2\System.dll (None)
     1 [TRUNCATED]\BA2004ManagedCppRepro\Dummy.cpp (SHA_256: 64E6D14E707AF8FDCB77BE5A5CA5BBBBF0C1714BFF164269DF00D5538D51DDE1)
     2 C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\.NETFramework\v4.7.2\mscorlib.dll (None)
     3 [TRUNCATED]\BA2004ManagedCppRepro\Dummy.h (SHA_256: B0B1F9855D76077F0C74C90470F60754BC7F15FE4699672D40F7E980739ED397)
     4 [TRUNCATED]\BA2004ManagedCppRepro\predefined C++ types (compiler internal) (None)
     5 [TRUNCATED]\BA2004ManagedCppRepro\predefined C++\CLI attribute types (compiler internal) (None)

Looking at the implementation for BA2004 there's variability in whether object files will be flagged, depending on the order in which the sources show up:

    // We only need to check a single source file per compiland, as the relevant
    // command-line options will be applied to all files in the translation unit.

So the way I've found to make it repro more reliably, is to add explicit references like:

  <ItemGroup>
    <Reference Include="System" />
  </ItemGroup>

which seems to make the .NET assemblies show up first in the "sources".

The warning class has some hardcoded exclusions for expected toolset stuff we see in the dump, like "predefined C++ types (compiler internal)", but not possible managed references.