Enter-PSHostProcess on a locked down (WDAC enforced) machine allows any admin to connect to any another local hosted PowerShell process and execute commands as that user. This amounts to privilege escalation on the policy locked down machine and something we want to prevent.
Fix is to check for system lock down and disable Enter-PSHostProcess cmdlet with an error message.
This PR combines all Windows PowerShell code changes needed for 6.1.
* Disallow ps1 files from being imported as modules in CL mode
* JEA loop back change to prevent code running in local session instead of remote session
* Debugger does not run commands with Internal origin when in CL mode
* Add support for new AMSI codes
* Unhandled exception fix
* Change to use AMSI buffer API
* Module vulnerabilities under CL mode
* Untrusted input tracking work
* Configuration keyword
* PSRP protocol version check for reconstruct reconnect
* Sharing initial session state over multiple runspace pool runspaces
* Restricted remote session in UMCI
* Applocker detection collision
* Help command exposing functions
Cherry picked from !5232
- Add VSTS CI for Windows
- Disable `Access-denied test for Get-Item C:\windows\appcompat\Programs\Install -ErrorAction Stop`, because the path does not always exist
- https://github.com/PowerShell/PowerShell/issues/7553
- Disable `Should give .sys file if the fullpath is specified with hidden and force parameter`, because pagefile.sys doesn't always exist and other files don't meet test's requirement.
- https://github.com/PowerShell/PowerShell/issues/7554
- Disable some `Test-Connection` tests for same reasons they failed on VSTS Linux
- https://github.com/PowerShell/PowerShell/issues/7555
- Disable `Test-FileCatalog should pass when catalog is in the same folder as files being tested`, because the CmdLet does not work in that scenario
- Also, give details needed to investigate when the test fails
- https://github.com/PowerShell/PowerShell/issues/7556
- Update `appveyor.psm1` to work with VSTS
- Update `HelpersRemoting.psm1` `New-RemoteSession` to work for CimSession (discovered an issue during the investigation)
- Update `Test wildcard with drive relative directory path` to work when there are multiple drives
- Disable on non-windows machines since the test is assuming drive letters
- Update `New-CimSession` Tests to requireAdmin
- Also, make sure session name is a string
- Add functions to save and restore psoptions
- update `.gitatttributes` so files clone like they do on appveyor
Convert ShouldBeErrorId to Should -Throw -ErrorId in PowerShell tests.
Get rid of try { } catch { } formula to assert that errors were thrown.
Small fixes in tests to obey the new Pester -Parameter syntax.
These changes port Windows PowerShell support for Applocker and DeviceGuard User Mode Code Integrity (UMCI) to PSCore6. Windows PowerShell uses public APIs to determine if a system is in locked down mode via AppLocker or DeviceGuard, and automatically runs in constrained language mode. For more information about PowerShell constrained language, see: https://blogs.msdn.microsoft.com/powershell/2017/11/02/powershell-constrained-language-mode/
This support for application whitelisting has mostly existed in PSCore6, but the primary APIs were stubbed out in CorePSStub.cs because they relied on Windows only DeviceGuard (wldp.dll) and AppLocker (Safer APIs) public APIs. These changes re-implement PowerShell lock down APIs on PSCore6 for Windows platforms only. The AppLocker and DeviceGuard public APIs are currently only implemented in Windows OSes and are not supported on Linux or MacOS platforms.
Tests have also been ported to PSCore6 and run only for Windows platforms.
Based on standard practices, we need to have a copyright and license notice at the top of each source file. Removed existing copyrights and updated/added copyright notices for .h, .cpp, .cs, .ps1, and .psm1 files.
Updated module manifests for consistency to have Author = "PowerShell" and Company = "Microsoft Corporation". Removed multiple line breaks.
Separate PR coming to update contribution document for new source files: #6140
Manually reviewed each change.
Fix#6073
Remove unnecessary check for Paths.count > 0 as there is code later to use the current working directory since -Path is not a mandatory parameter.
Updated ShouldProcess to output the internal action on adding paths rather than the user action (which is the cmdlet name).
Updated tests to not specify -Path
Fix#5594
* Add file secret suppression
* Add line secret suppression
* This will be consumed in the VSTS daily build.
* Renamed tests with ConvertTo-SecureString to avoid false positives
- add ending newline to files missing it using:
`awk -F: '$2 ~ / no line terminators/ {print $1}' ~/text-files.txt | xargs -I{} sh -c 'printf "\n" >> "$1"' - {}`
- update .gitattributes to enforce autocrlf on all text files
- added <copyright> opening element where it was missing
removed file attribute pointing to wrong filename
- fix mis-encoded character to apostrophe
- replace incorrect encoding of copyright symbol with (c)
- updated file hashes in the test
* Make count of tests the same between Windows and Non-Windows platforms
Change logic so test cases are created for all platforms, but only load the helper module on windows
* Ensure Get-ComputerInfo tests run the same number of tests regardless of platform
- Fix PSScriptAnalyzer warnings of type PSAvoidUsingCmdletAliases for 'ForEach-Object' (alias is '%' or 'foreach')
- Fix PSScriptAnalyzer warnings of type PSAvoidUsingCmdletAliases for 'Where-Object' (alias is '?' or 'where')
- Fix PSScriptAnalyzer warnings of type PSAvoidUsingCmdletAliases for 'Select-Object' (alias is 'select')
- Fix PSScriptAnalyzer warnings of type PSPossibleIncorrectComparisonWithNull. Essentially, $null has to be on the left-hand side when using it for comparison.
- A Test in ParameterBinding.Tests.ps1 needed adapting as this test used to rely on the wrong null comparison
- Replace a subset of tests of kind '($object -eq $null) | Should Be $true' with '$object | Should Be $null'
The code paths deleted where using the undocumented Win32 APIs on WIn8 and newer for the following purposes:
* Faster filtering
* Getting two properties (left empty on Win7 and below)
* Logging using Certificate components when a cert is deleted or copied.
After the change, all the code uses public APIs. Filtering is done in PowerShell using existing code. I don't believe the logging is needed.
Related #3238
1. Add autoload for test modules
2. Move TestHostCS.psm1 to 'test\tools\Modules\' folder
3. Remove explicit load TestHostCS.psm1 from test files
* corrected use of PSModulePath casing to be consistent with Windows PowerShell
addresses #3227
* addressing review feedback
make "PSModulePath" into const
fixed some test workarounds due to failures for external reasons that wasn't meant to be checked in
* addressing review feedback
make "PSModulePath" into const
fixed some test workarounds due to failures for external reasons that wasn't meant to be checked in
* Add ShouldProcess to New-FileCatalog and Test-FileCatalog
Close#3068
Add support `-WhatIf` and `-Confirm` to `New-FileCatalog` and add a
test.
`Test-FileCatalog` has a common code base with `New-FileCatalog` so it
automatically get the same. I believe that adding a separate test in
this case doesn't make sense.
* Fiz after code review
Remove _ShouldProcess
Add var in test
* Fix GetType() bad pattern and related issues in tests
$var.GetType() can raise an exception in tests so we should check $var
before make the call. A large part of the tests does not make this
check.
I start with searching ".GetType()" but discovered many related issues
in tests (reduntant and unneeded tests, "throw" bad pattens, bugs,
formattings (sorry!) and so on) - I had to fix them too.
* Fix after code review
* Second wave of migration GetType() -> BeOfType
Removed 'GetType().Name' patterns.
* Improve console cmdlets tests
Main improvements refer to tests of the Write-Host cmdlet.
Original tests:
1. Slow because run external processes
2. Don't test colors and -NoNewLine in fact.
1. The original tests is preserved (deleted one as redundant) but marked
by 'Slow' tag. They is preserved because they actually check the output
on the work, not a test console.
2. Add negative color tests. (Code cover grow!)
3. Add tests based on TestHostCS. This test host has been refined so we
can see colors and a new line in output.
4. Add minor fixes for test modules loads.
Also I add support for Information stream. I originally planned to use
it but not actually used. However, I have left this as a useful addition
for future tests.
I wonder that a Write-Host console output is duplicated in Information
Stream - Is it by design? I left a debug print on this matter in the
test code.
* Fix after code review
* Corrections after code review
Suppress import-module warnings
Rename Describes
Add "-Object" test
Add Stream.Information tests with TestHostCS
* Add checks for Streams.Information and add comments
* All test reported as skipped if not applicable to the platform
Fixed files:
powershell\Modules\Microsoft.PowerShell.Management\Clear-EventLog.Tests.ps1:1:if
($IsWindows -and !$IsCoreCLR) {
powershell\Modules\Microsoft.PowerShell.Management\Get-ComputerInfo.Tests.ps1:1325:
return
powershell\Modules\Microsoft.PowerShell.Management\Get-EventLog.Tests.ps1:1:if
($IsWindows -and !$IsCoreCLR) {
powershell\Modules\Microsoft.PowerShell.Management\New-EventLog.Tests.ps1:1:if
($IsWindows -and !$IsCoreCLR) {
powershell\Modules\Microsoft.PowerShell.Management\Registry.Tests.ps1:7:
if ($IsWindows -eq $false) {
powershell\Modules\Microsoft.PowerShell.Management\Registry.Tests.ps1:167:
if ($IsWindows -eq $false) {
powershell\Modules\Microsoft.PowerShell.Management\Remove-EventLog.Tests.ps1:1:if
($IsWindows -and !$IsCoreCLR) {
powershell\Modules\Microsoft.PowerShell.Management\TimeZone.Tests.ps1:17:if
($IsWindows) {
powershell\Modules\Microsoft.PowerShell.Security\FileCatalog.Tests.ps1:6:if
($IsWindows) {
powershell\engine\Help\HelpSystem.Tests.ps1:112: if ($IsWindows)
* Fix test after code review
* Move skiping to common 'try'
* Update CredentialCommands.cs
Added possibility to add title to the credential prompt window.
Added possibility to only supply username without giving a message.
* Added Test for Get-Credential new feature. (Title, and Message only optional.)
Paul Higinbotham