Enable more MSVC warnings for SDL signoff

src/Servers/IIS/AspNetCoreModuleV2/IISLib/IISLib.vcxproj

@@ -78,11 +78,17 @@
     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
   </ImportGroup>
   <PropertyGroup Label="UserMacros" />
+  <ItemDefinitionGroup>
+    <ClCompile>
+      <!-- Microsoft.Security.SystemsADM.10086 - SDL required warnings -->
+      <WarningLevel>Level4</WarningLevel>
+      <TreatSpecificWarningsAsErrors>4018;4055;4146;4242;4244;4267;4302;4308;4509;4510;4532;4533;4610;4611;4700;4701;4703;4789;4995;4996</TreatSpecificWarningsAsErrors>
+    </ClCompile>
+  </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32' OR'$(Configuration)|$(Platform)'=='Debug|x64' OR '$(Configuration)|$(Platform)'=='Debug|ARM64' OR '$(Configuration)|$(Platform)'=='Debug|Any CPU'">
     <ClCompile>
       <PrecompiledHeader>
       </PrecompiledHeader>
-      <WarningLevel>Level3</WarningLevel>
       <Optimization>Disabled</Optimization>
       <PreprocessorDefinitions>WIN32;NDEBUG;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <SDLCheck>true</SDLCheck>
@@ -99,7 +105,6 @@
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32' OR '$(Configuration)|$(Platform)'=='Release|x64' OR '$(Configuration)|$(Platform)'=='Release|ARM64' OR '$(Configuration)|$(Platform)'=='Release|Any CPU'">
     <ClCompile>
-      <WarningLevel>Level3</WarningLevel>
       <PrecompiledHeader>
       </PrecompiledHeader>
       <Optimization>MaxSpeed</Optimization>

src/Servers/IIS/AspNetCoreModuleV2/IISLib/acache.cpp

@@ -14,6 +14,9 @@ HANDLE  ALLOC_CACHE_HANDLER::sm_hHeap;
 // memory block to a FREE_LIST_HEADER*.  The signature is used to guard against
 // double deletion.  We also fill memory with a pattern.
 //
+// Disabling C4324 here; alignment comes from SLIST_ENTRY definition.
+#pragma warning(push)
+#pragma warning(disable:4324) 
 class FREE_LIST_HEADER
 {
 public:
@@ -25,6 +28,7 @@ class FREE_LIST_HEADER
         FREE_SIGNATURE = (('A') | ('C' << 8) | ('a' << 16) | (('$' << 24) | 0x80)),
     };
 };
+#pragma warning(pop)
 
 ALLOC_CACHE_HANDLER::ALLOC_CACHE_HANDLER(
 ) : m_nThreshold(0),
@@ -223,6 +227,7 @@ ALLOC_CACHE_HANDLER::Alloc(
             // on memory that they've freed.
             //
             DBG_ASSERT(pfl->dwSignature == FREE_LIST_HEADER::FREE_SIGNATURE);
+            (void)pfl;
         }
     }
 

src/Servers/IIS/AspNetCoreModuleV2/IISLib/stringa.cpp

@@ -679,7 +679,7 @@ Return Value:
     int     i      = 0;
     BYTE    ch;
     HRESULT hr      = S_OK;
-    SIZE_T  NewSize = 0;
+    ULONG64  NewSize = 0;
 
     // Set to true if any % escaping occurs
     BOOL fEscapingDone = FALSE;
@@ -695,13 +695,14 @@ Return Value:
 
     _ASSERTE( pch );
 
-    while (ch = pch[i])
+    while (pch[i] != NULL)
     {
         //
         //  Escape characters that are in the non-printable range
         //  but ignore CR and LF
         //
 
+        ch = pch[i];
         if ( pfnFShouldEscape( ch ) )
         {
             if (FALSE == fEscapingDone)
@@ -711,7 +712,7 @@ Return Value:
 
                 // guess that the size needs to be larger than
                 // what we used to have times two
-                NewSize = QueryCCH() * 2;
+                NewSize = static_cast<ULONG64>(QueryCCH()) * 2;
                 if ( NewSize > MAXDWORD )
                 {
                     hr = HRESULT_FROM_WIN32( ERROR_ARITHMETIC_OVERFLOW );
@@ -740,14 +741,14 @@ Return Value:
 
             // resize the temporary (if needed) with the slop of the entire buffer length
             // this fixes constant reallocation if the entire string needs to be escaped
-            NewSize = QueryCCH() + 2 * sizeof(CHAR) + 1 * sizeof(CHAR);
+            NewSize = static_cast<ULONG64>(QueryCCH()) + 2 * sizeof(CHAR) + 1 * sizeof(CHAR);
             if ( NewSize > MAXDWORD )
             {
                 hr = HRESULT_FROM_WIN32( ERROR_ARITHMETIC_OVERFLOW );
                 return hr;
             }
 
-            BOOL fRet = straTemp.m_Buff.Resize(NewSize);
+            BOOL fRet = straTemp.m_Buff.Resize(static_cast<size_t>(NewSize));
             if ( !fRet )
             {
                 hr = HRESULT_FROM_WIN32(GetLastError());
@@ -1038,6 +1039,7 @@ STRA::AuxAppendW(
 {
     HRESULT hr          = S_OK;
     DWORD   cbRet       = 0;
+    UNREFERENCED_PARAMETER(fFailIfNoTranslation);
 
     //
     // There are only two expect places to append
@@ -1663,9 +1665,7 @@ STRA::IndexOf(
     __in DWORD          dwStartIndex
     ) const
 {
-    HRESULT hr = S_OK;
     INT nIndex = -1;
-    SIZE_T cchValue = 0;
 
     // Validate input parameters
     if( dwStartIndex >= QueryCCH() || !pszValue )

src/Servers/IIS/AspNetCoreModuleV2/IISLib/stringu.cpp

@@ -774,9 +774,9 @@ Return Value:
     //  Only resize when we have to.  When we do resize, we tack on
     //  some extra space to avoid extra reallocations.
     //
-    if( m_Buff.QuerySize() < (ULONGLONG)cbOffset + (cbStr * sizeof( WCHAR )) + sizeof(WCHAR) )
+    if (m_Buff.QuerySize() < (ULONGLONG)cbOffset + (cbStr * sizeof(WCHAR)) + sizeof(WCHAR))
     {
-        ULONGLONG cb64NewSize = (ULONGLONG)( cbOffset + cbStr * sizeof(WCHAR) + sizeof( WCHAR ) );
+        ULONGLONG cb64NewSize = (ULONGLONG)cbOffset + (ULONGLONG)cbStr * sizeof(WCHAR) + sizeof(WCHAR);
 
         //
         // Check for the arithmetic overflow
@@ -1099,9 +1099,7 @@ STRU::IndexOf(
     __in DWORD          dwStartIndex
     ) const
 {
-    HRESULT hr = S_OK;
     INT nIndex = -1;
-    SIZE_T cchValue = 0;
 
     // Validate input parameters
     if( dwStartIndex >= QueryCCH() || !pwszValue )

src/Servers/IIS/build/Build.Common.Settings

@@ -43,7 +43,9 @@
       <PrecompiledHeaderOutputFile>$(IntDir)$(TargetName).pch</PrecompiledHeaderOutputFile>
       <ForcedIncludeFiles>stdafx.h</ForcedIncludeFiles>
       <TreatWarningAsError>true</TreatWarningAsError>
+      <!-- Microsoft.Security.SystemsADM.10086 - SDL required warnings -->
       <WarningLevel>Level4</WarningLevel>
+      <TreatSpecificWarningsAsErrors>4018;4055;4146;4242;4244;4267;4302;4308;4509;4510;4532;4533;4610;4611;4700;4701;4703;4789;4995;4996</TreatSpecificWarningsAsErrors>
       <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
       <ShowIncludes>false</ShowIncludes>
       <MultiProcessorCompilation>true</MultiProcessorCompilation>