From c986ccc1ff5fb6236d23a25a9e2000d1c74fe196 Mon Sep 17 00:00:00 2001
From: PowerShell Team Bot <69177312+pwshBot@users.noreply.github.com>
Date: Thu, 9 Oct 2025 15:54:45 -0700
Subject: [PATCH] [release/v7.4] add CodeQL suppressions for UpdatableHelp and
 NativeCommandProcessor methods (#26172)

---
 .../engine/NativeCommandProcessor.cs                            | 2 ++
 src/System.Management.Automation/help/UpdatableHelpSystem.cs    | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/src/System.Management.Automation/engine/NativeCommandProcessor.cs b/src/System.Management.Automation/engine/NativeCommandProcessor.cs
index d4ee597cf6..f0e18b315e 100644
--- a/src/System.Management.Automation/engine/NativeCommandProcessor.cs
+++ b/src/System.Management.Automation/engine/NativeCommandProcessor.cs
@@ -658,6 +658,8 @@ namespace System.Management.Automation
                                 {
                                     startInfo.ArgumentList.RemoveAt(0);
                                 }
+
+                                // codeql[cs/microsoft/command-line-injection-shell-execution] - This is expected Poweshell behavior where user inputted paths are supported for the context of this method. The user assumes trust for the file path specified on the user's system to retrieve process info for, and in the case of remoting, restricted remoting security guidelines should be used.
                                 startInfo.FileName = oldFileName;
                             }
                         }
diff --git a/src/System.Management.Automation/help/UpdatableHelpSystem.cs b/src/System.Management.Automation/help/UpdatableHelpSystem.cs
index 6ab8d469a9..14edabf961 100644
--- a/src/System.Management.Automation/help/UpdatableHelpSystem.cs
+++ b/src/System.Management.Automation/help/UpdatableHelpSystem.cs
@@ -419,6 +419,7 @@ namespace System.Management.Automation.Help
                         using (HttpClient client = new HttpClient(handler))
                         {
                             client.Timeout = new TimeSpan(0, 0, 30); // Set 30 second timeout
+                            // codeql[cs/ssrf] - This is expected Poweshell behavior and the user assumes trust for the module they download and any URIs it references. The URIs are also not executables or scripts that would be invoked by this method.
                             Task<HttpResponseMessage> responseMessage = client.GetAsync(uri);
                             using (HttpResponseMessage response = responseMessage.Result)
                             {
@@ -783,6 +784,7 @@ namespace System.Management.Automation.Help
                 using (HttpClient client = new HttpClient(handler))
                 {
                     client.Timeout = _defaultTimeout;
+                    // codeql[cs/ssrf] - This is expected Poweshell behavior and the user assumes trust for the module they download and any URIs it references. The URIs are also not executables or scripts that would be invoked by this method.
                     Task<HttpResponseMessage> responseMsg = client.GetAsync(new Uri(uri), _cancelTokenSource.Token);
 
                     // TODO: Should I use a continuation to write the stream to a file?