[Bug]: Binskim error (BA2007): Abseil disables warnings (4244;4267) for MSVC compiler

[gottacodeemall]

Describe the issue

• Receiving Binskim (Microsoft's static code analysis tool) errors while using abseil through vcpkg as package manager.
• abseil configures to disable certain warnings in their cmake.
• We don't want to get into the weeds of either directly editing the cmake file ourselves or patching the cmake file in the vcpkg port

Error description:
error BA2007: '{{abseil.dll}}' disables compiler warning(s) which are required by policy.
Modules triggering this check were:
bad_variant_access.cc.obj (absl_bad_variant_access.lib) [Explicitly disabled warnings: 4244;4267]

Abseil code leading to the errors on Binskim:

• Flags
• CMake

Steps to reproduce the problem

• Build abseil
  • Setup
    • vcpkg
    • msvc compiler
    • windows
    • Latest version of abseil should do
• Use binskim to scan the dll's and pdb's of abseil

What version of Abseil are you using?

Latest / any version of abseil with the warning flags disabled should do

What operating system and version are you using?

Windows 11 Enterprise 10.0.22631

What compiler and version are you using?

MSVC

What build system are you using?

cmake 3.30

Additional context

No response

[derekmauro]

I'm going to fix the warnings in the library code and enable the warning. For now I'm going to keep the warning disabled in tests, since it is more effort to fix. Hopefully that is good enough.

[gottacodeemall]

Yup, that works.

Temporary Mitigation:
As a temporary mitigation on our side, I have introduced a patch to abseil-cpp in our codebase.

Patch:

      diff --git a/absl/copts/GENERATED_AbseilCopts.cmake b/absl/copts/GENERATED_AbseilCopts.cmake
      index da2282fe..4c7fc26f 100644
      --- a/absl/copts/GENERATED_AbseilCopts.cmake
      +++ b/absl/copts/GENERATED_AbseilCopts.cmake
      @@ -181,8 +181,6 @@ list(APPEND ABSL_MSVC_FLAGS
           "/wd4005"
           "/wd4068"
           "/wd4180"
      -    "/wd4244"
      -    "/wd4267"
           "/wd4503"
           "/wd4800"
           "/DNOMINMAX"

Long term Strategy:
Once this fix goes into an abseil release and vcpkg picks this latest release up, we can bump up our vcpkg baseline and remove the temporary patch introduced in our codebase.

Things to look into:
Although not blocking, do check if rest of the warnings actually need to be disabled in the first place.
Might be a larger effort from abseil as this would mean validating across multiple compilers and warning flags.