admin/PowerShell-PowerShell
1
0
Fork 0
mirror of https://github.com/PowerShell/PowerShell synced 2026-06-08 12:12:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

[release/v7.7.0-preview.1] Update MaxVisitCount and MaxHashtableKeyCount if VisitorSafeValueContext indicates SkipLimitCheck is true (#27308)

Browse Source 
Co-authored-by: Patrick Meinecke <SeeminglyScience@users.noreply.github.com>
Co-authored-by: Dongbo Wang <dongbow@microsoft.com>
This commit is contained in:
Justin Chung
2026-04-20 14:31:17 -05:00
committed by GitHub
co-authored by Patrick Meinecke Dongbo Wang
parent 64656b3ced
commit 5b00d0f40b
2 changed files with 15 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/System.Management.Automation/engine/parser/SafeValues.cs
+9 -5
View File
@@ -47,11 +47,15 @@ namespace System.Management.Automation.Language
internal IsSafeValueVisitor(GetSafeValueVisitor.SafeValueContext safeValueContext)
{
_safeValueContext = safeValueContext;
bool skipSizeCheck = safeValueContext is GetSafeValueVisitor.SafeValueContext.SkipHashtableSizeCheck;
_maxVisitCount = skipSizeCheck ? uint.MaxValue : 5000;
_maxHashtableKeyCount = skipSizeCheck ? int.MaxValue : 500;
}
internal bool IsAstSafe(Ast ast)
{
if ((bool)ast.Accept(this) && _visitCount < MaxVisitCount)
if ((bool)ast.Accept(this) && _visitCount < _maxVisitCount)
{
return true;
}
@@ -65,8 +69,8 @@ namespace System.Management.Automation.Language
// This is a check of the number of visits
private uint _visitCount = 0;
private const uint MaxVisitCount = 5000;
private const int MaxHashtableKeyCount = 500;
private readonly uint _maxVisitCount;
private readonly int _maxHashtableKeyCount;
// Used to determine if we are being called within a GetPowerShell() context,
// which does some additional security verification outside of the scope of
@@ -330,7 +334,7 @@ namespace System.Management.Automation.Language
public object VisitHashtable(HashtableAst hashtableAst)
{
if (hashtableAst.KeyValuePairs.Count > MaxHashtableKeyCount)
if (hashtableAst.KeyValuePairs.Count > _maxHashtableKeyCount)
{
return false;
}
@@ -373,7 +377,7 @@ namespace System.Management.Automation.Language
{
t_context = context;
if (safeValueContext == SafeValueContext.SkipHashtableSizeCheck || IsSafeValueVisitor.IsAstSafe(ast, safeValueContext))
if (IsSafeValueVisitor.IsAstSafe(ast, safeValueContext))
{
return ast.Accept(new GetSafeValueVisitor());
}
test/powershell/Modules/Microsoft.PowerShell.Utility/PowerShellData.tests.ps1
+6
View File
@@ -49,4 +49,10 @@ Describe "Tests for the Import-PowerShellDataFile cmdlet" -Tags "CI" {
$result = Import-PowerShellDataFile $largePsd1Path -SkipLimitCheck
$result.Keys.Count | Should -Be 501
}
It 'Fails if psd1 file is insecure while -SkipLimitCheck is used' {
$path = Setup -f insecure2.psd1 -Content '@{ Foo = [object] (calc.exe) }' -pass
{ Import-PowerShellDataFile $path -SkipLimitCheck -ErrorAction Stop } |
Should -Throw -ErrorId "System.InvalidOperationException,Microsoft.PowerShell.Commands.ImportPowerShellDataFileCommand"
}
}