Fix security check for executables

protocol/openconnect/client.go

@@ -83,6 +83,24 @@ func NewEndpoint(ctx context.Context, router adapter.Router, logger log.ContextL
 	} else if options.TCPKeepAlive == 0 && options.TCPKeepAliveInterval == 0 {
 		options.TCPKeepAliveSystemDefaults = true
 	}
+	if options.CSD != nil && options.CSD.WrapperPath != "" {
+		err := adapter.CheckSecurityFeature(ctx, "OpenConnect `csd.wrapper_path`")
+		if err != nil {
+			return nil, err
+		}
+	}
+	if options.HIP != nil && options.HIP.WrapperPath != "" {
+		err := adapter.CheckSecurityFeature(ctx, "OpenConnect `hip.wrapper_path`")
+		if err != nil {
+			return nil, err
+		}
+	}
+	if options.TNCC != nil && options.TNCC.WrapperPath != "" {
+		err := adapter.CheckSecurityFeature(ctx, "OpenConnect `tncc.wrapper_path`")
+		if err != nil {
+			return nil, err
+		}
+	}
 	options.UDPBindPort = options.DTLSLocalPort
 	loopContext, cancelLoop := context.WithCancel(ctx)
 	openConnectEndpoint := &Endpoint{

protocol/tor/outbound.go

@@ -45,6 +45,10 @@ type Outbound struct {
 }
 
 func NewOutbound(ctx context.Context, router adapter.Router, logger log.ContextLogger, tag string, options option.TorOutboundOptions) (adapter.Outbound, error) {
+	err := adapter.CheckSecurityFeature(ctx, "Tor outbound")
+	if err != nil {
+		return nil, err
+	}
 	var startConf tor.StartConf
 	startConf.DataDir = os.ExpandEnv(options.DataDirectory)
 	if startConf.DataDir != "" {
@@ -74,10 +78,6 @@ func NewOutbound(ctx context.Context, router adapter.Router, logger log.ContextL
 	}
 	startConf.ExtraArgs = options.ExtraArgs
 	if options.ExecutablePath != "" {
-		err := adapter.CheckSecurityFeature(ctx, "Tor `executable_path`")
-		if err != nil {
-			return nil, err
-		}
 		startConf.ExePath = options.ExecutablePath
 		startConf.ProcessCreator = nil
 		startConf.UseEmbeddedControlConn = false