Rule request: `AvoidSecureStringDisclosure`
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
Research direction
Start by locating the existing PSScriptAnalyzer rule implementations and tests, then compare their handling of ConvertFrom-SecureString, SecureStringToBSTR, and PSCredential.GetNetworkCredential(). The work is done when unsafe SecureString-to-plaintext patterns are reliably reported and corresponding analyzer tests cover the examples in the issue.
Written by the indexing model from the issue text.
Description
As for AvoidUsingConvertToSecureStringWithPlainText it should be avoided to retrieve a PlainText password from a SecureString as it might leave memory trials (or even logging trails).
$Password = $SecureString | ConvertFrom-SecureString -AsPlainText
Besides, the action that follows and requires the plaintext password is likely vulnerable from a security aspect.
This will also include the common used statements as:
(see: https://stackoverflow.com/a/28353003/1701026)
$SecurePassword = ConvertTo-SecureString $PlainPassword -AsPlainText -Force
$BSTR = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($SecurePassword)
$Password = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($BSTR)
[Runtime.InteropServices.Marshal]::ZeroFreeBSTR($BSTR)
and (see: https://stackoverflow.com/a/40166959/1701026):
$Password = (New-Object PSCredential 0, $SecurePassword).GetNetworkCredential().Password
The general approach of dealing with credentials is to avoid them and instead rely on other means to authenticate, such as certificates or Windows authentication.
Proposed technical implementation details (optional)
Create rules to check for the above mentioned unsafe statements.
- Dominant language
- C#
- Stars
- 2.2k
- Forks
- 415
- Avg merge
- 13h 1m
- Merged PRs (30d)
- 2
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from PowerShell/PSScriptAnalyzer
-
Up-for-Grabs
Difficulty 1/5 1-3 hours Newbie friendliness 78/100
PowerShell/PSScriptAnalyzer#2213 · 2 comments ·
-
Difficulty 3/5 1-2 days Newbie friendliness 72/100
PowerShell/PSScriptAnalyzer#2217 · 1 comment ·
-
PSUseConsistentIndentation double-indents attribute bodies that open a scriptblock (`[Attr({ … })]`) Open
Difficulty 3/5 1-2 days Newbie friendliness 70/100
PowerShell/PSScriptAnalyzer#2216 · 2 comments ·
-
Difficulty 3/5 1-2 days Newbie friendliness 68/100
PowerShell/PSScriptAnalyzer#2211 ·
-
`PSPlaceOpenBrace` and `PSPlaceCloseBrace` leave trailing whitespace when expanding one-line blocks Open
Difficulty 3/5 1-2 days Newbie friendliness 70/100
PowerShell/PSScriptAnalyzer#2210 ·
All issues in PowerShell/PSScriptAnalyzer
Similar issues
-
:watch: Not Triaged dotnet-fsharp/svc
Difficulty 1/5 Under an hour Newbie friendliness 90/100
-
Client customer-reported needs-team-attention question Service Attention WebPubSub
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Azure/azure-sdk-for-net#63292 · 3 comments · 1 reaction ·
-
Issue-Enhancement Needs-Triage
Difficulty 1/5 Under an hour Newbie friendliness 86/100
PowerShell/PowerShell#28061 · 2 reactions ·
-
dependencies needs-team-triage server-Azure.Mcp
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
aspnet-core/svc aspnetcore-signalr/subsvc doc-enhancement Pri2 SignalR
Difficulty 1/5 Under an hour Newbie friendliness 88/100
dotnet/AspNetCore.Docs#37729 ·