Skip to content

Updated Engine to use AddCommand to prevent Script Based injection attacks #353

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Nov 10, 2015
Merged

Updated Engine to use AddCommand to prevent Script Based injection attacks #353

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8e3a0cd
Updated Engine to use AddCommand to prevent Script Based injection at…
raghushantha Nov 10, 2015
4454618
Check for null Description Property in the returned help content
raghushantha Nov 10, 2015
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 26 additions & 12 deletions Engine/ScriptAnalyzer.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@
using System.Globalization;
using System.Collections.Concurrent;
using System.Threading.Tasks;
using System.Collections.ObjectModel;

namespace Microsoft.Windows.PowerShell.ScriptAnalyzer
{
Expand Down Expand Up @@ -545,18 +546,19 @@ private List<ExternalRule> GetExternalRule(string[] moduleNames)
using (System.Management.Automation.PowerShell posh =
System.Management.Automation.PowerShell.Create(state))
{
string script = string.Format(CultureInfo.CurrentCulture, "Get-Module -Name '{0}' -ListAvailable", moduleName);
shortModuleName = posh.AddScript(script).Invoke<PSModuleInfo>().First().Name;
posh.AddCommand("Get-Module").AddParameter("Name", moduleName).AddParameter("ListAvailable");
shortModuleName = posh.Invoke<PSModuleInfo>().First().Name;

// Invokes Update-Help for this module
// Required since when invoking Get-Help later on, the cmdlet prompts for Update-Help interactively
// By invoking Update-Help first, Get-Help will not prompt for downloading help later
script = string.Format(CultureInfo.CurrentCulture, "Update-Help -Module '{0}' -Force", shortModuleName);
posh.AddScript(script).Invoke();

posh.AddCommand("Update-Help").AddParameter("Module", shortModuleName).AddParameter("Force");
posh.Invoke();
// Invokes Get-Command and Get-Help for each functions in the module.
script = string.Format(CultureInfo.CurrentCulture, "Get-Command -Module '{0}'", shortModuleName);
var psobjects = posh.AddScript(script).Invoke();
posh.Commands.Clear();
posh.AddCommand("Get-Command").AddParameter("Module", shortModuleName);
var psobjects = posh.Invoke();

foreach (PSObject psobject in psobjects)
{
Expand All @@ -570,10 +572,22 @@ private List<ExternalRule> GetExternalRule(string[] moduleNames)
//Only add functions that are defined as rules.
if (param != null)
{
script = string.Format(CultureInfo.CurrentCulture, "(Get-Help -Name {0}).Description | Out-String", funcInfo.Name);
string desc = posh.AddScript(script).Invoke()[0].ImmediateBaseObject.ToString()
.Replace("\r\n", " ").Trim();
posh.AddCommand("Get-Help").AddParameter("Name", funcInfo.Name);
Collection<PSObject> helpContent = posh.Invoke();

// Retrieve "Description" field in the help content
string desc = String.Empty;

if ((null != helpContent) && ( 1 == helpContent.Count))
{
dynamic description = helpContent[0].Properties["Description"];

if (null != description)
{
desc = description.Value[0].Text;
}
}

rules.Add(new ExternalRule(funcInfo.Name, funcInfo.Name, desc, param.Name, param.ParameterType.FullName,
funcInfo.ModuleName, funcInfo.Module.Path));
}
Expand Down Expand Up @@ -784,8 +798,8 @@ public Dictionary<string, List<string>> CheckRuleExtension(string[] path, PathIn
using (System.Management.Automation.PowerShell posh =
System.Management.Automation.PowerShell.Create())
{
string script = string.Format(CultureInfo.CurrentCulture, "Get-Module -Name '{0}' -ListAvailable", resolvedPath);
PSModuleInfo moduleInfo = posh.AddScript(script).Invoke<PSModuleInfo>().First();
posh.AddCommand("Get-Module").AddParameter("Name", resolvedPath).AddParameter("ListAvailable");
PSModuleInfo moduleInfo = posh.Invoke<PSModuleInfo>().First();

// Adds original path, otherwise path.Except<string>(validModPaths) will fail.
// It's possible that user can provide something like this:
Expand Down