From 983ad2c0110afeab9d702fb77ddbca3ae463b30c Mon Sep 17 00:00:00 2001
From: Gatefixer <313497061+lancedb-gatefixer[bot]@users.noreply.github.com>
Date: Thu, 6 Aug 2026 08:35:42 +0000
Subject: [PATCH] fix(node): reject target feature cfg overrides

---
 nodejs/build_support/x86_64_v2.rs | 70 ++++++++++++++++++++++++++++++-
 1 file changed, 69 insertions(+), 1 deletion(-)

diff --git a/nodejs/build_support/x86_64_v2.rs b/nodejs/build_support/x86_64_v2.rs
index 8161b5820..d2b035d71 100644
--- a/nodejs/build_support/x86_64_v2.rs
+++ b/nodejs/build_support/x86_64_v2.rs
@@ -112,7 +112,16 @@ fn codegen_options(encoded: &str) -> Result<Vec<&str>, String> {
 
     while index < arguments.len() {
         let argument = arguments[index];
-        if argument == "-C" || argument == "--codegen" {
+        if argument == "--cfg" {
+            index += 1;
+            let cfg = arguments
+                .get(index)
+                .copied()
+                .ok_or_else(|| "missing value after --cfg".to_owned())?;
+            reject_builtin_target_feature_cfg(cfg)?;
+        } else if let Some(cfg) = argument.strip_prefix("--cfg=") {
+            reject_builtin_target_feature_cfg(cfg)?;
+        } else if argument == "-C" || argument == "--codegen" {
             index += 1;
             let option = arguments
                 .get(index)
@@ -132,6 +141,15 @@ fn codegen_options(encoded: &str) -> Result<Vec<&str>, String> {
     Ok(options)
 }
 
+fn reject_builtin_target_feature_cfg(cfg: &str) -> Result<(), String> {
+    let name = cfg.split_once('=').map_or(cfg, |(name, _)| name).trim();
+    let name = name.strip_prefix("r#").unwrap_or(name);
+    if name == "target_feature" {
+        return Err("built-in target_feature cfgs can override runtime CPU detection".to_owned());
+    }
+    Ok(())
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -170,6 +188,13 @@ mod tests {
         assert_eq!(validate_encoded_rustflags(&flags), Ok(()));
     }
 
+    #[test]
+    fn accepts_unrelated_custom_cfg() {
+        let flags = encoded(&["--cfg=tokio_unstable"]);
+
+        assert_eq!(validate_encoded_rustflags(&flags), Ok(()));
+    }
+
     #[test]
     fn accepts_explicit_x86_64_v1_cpu() {
         let flags = encoded(&["-Ctarget-cpu=x86-64"]);
@@ -276,4 +301,47 @@ mod tests {
             Err("rustc response-file arguments cannot be validated".to_owned())
         );
     }
+
+    #[test]
+    fn rejects_split_builtin_target_feature_cfg() {
+        let flags = encoded(&[
+            "-Ctarget-cpu=x86-64-v2",
+            "--cfg",
+            r#"target_feature="avx2""#,
+            "-Aexplicit_builtin_cfgs_in_flags",
+        ]);
+
+        assert_eq!(
+            validate_encoded_rustflags(&flags),
+            Err("built-in target_feature cfgs can override runtime CPU detection".to_owned())
+        );
+    }
+
+    #[test]
+    fn rejects_equals_builtin_target_feature_cfg() {
+        let flags = encoded(&[
+            "-Ctarget-cpu=x86-64-v2",
+            r#"--cfg=target_feature="avx2""#,
+            "-Aexplicit_builtin_cfgs_in_flags",
+        ]);
+
+        assert_eq!(
+            validate_encoded_rustflags(&flags),
+            Err("built-in target_feature cfgs can override runtime CPU detection".to_owned())
+        );
+    }
+
+    #[test]
+    fn rejects_raw_identifier_builtin_target_feature_cfg() {
+        let flags = encoded(&[
+            "-Ctarget-cpu=x86-64-v2",
+            r#"--cfg=r#target_feature="avx2""#,
+            "-Aexplicit_builtin_cfgs_in_flags",
+        ]);
+
+        assert_eq!(
+            validate_encoded_rustflags(&flags),
+            Err("built-in target_feature cfgs can override runtime CPU detection".to_owned())
+        );
+    }
 }