Rule Request: `AvoidPlaintextParameterPasswords`
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
Research direction
Start by comparing the requested behavior with the existing AvoidUsingPlainTextForPassword rule and the PowerShell examples in the issue. Define how bound String parameters named Password on external or binary cmdlets should be detected, including alternate variable names and static values, and use the linked issues to resolve scope before considering the work done.
Written by the indexing model from the issue text.
Description
Similar to the rule AvoidUsingPlainTextForPassword, passing plaintext passwords to external/binary cmdlets should be avoided.
This includes cmdlets as e.g.:
PS C:\> Get-Command -ParameterName Password
CommandType Name Version Source
----------- ---- ------- ------
Function Register-ScheduledTask 1.0.0.0 ScheduledTasks
Function Set-ScheduledTask 1.0.0.0 ScheduledTasks
But could potentially any imported (binary) cmdlet with a bound parameter named Password and of type String
Knowing that the AvoidUsingPlainTextForPassword rule might not capture the security risk when using a different variable name (e.g. -Password $Wachtwoord) or a password that is statically provided:
Invoke-ScriptAnalyzer -ScriptDefinition {
Set-ScheduledTask -TaskName 'SoftwareScan' -Trigger $Time -User 'User' -Password 'P@ssw0rd'
}.ToString()
Related:
- Rule request: AvoidSecureStringDisclosure #1997
- PowerShell issue: https://github.com/PowerShell/PowerShell/issues/26366 and https://github.com/PowerShell/PowerShell/issues/16502
- Document issue: https://github.com/MicrosoftDocs/windows-powershell-docs/issues/4051
- Dominant language
- C#
- Stars
- 2.2k
- Forks
- 415
- Avg merge
- 13h 1m
- Merged PRs (30d)
- 2
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from PowerShell/PSScriptAnalyzer
-
Up-for-Grabs
Difficulty 1/5 1-3 hours Newbie friendliness 78/100
PowerShell/PSScriptAnalyzer#2213 · 2 comments ·
-
Difficulty 3/5 1-2 days Newbie friendliness 72/100
PowerShell/PSScriptAnalyzer#2217 · 1 comment ·
-
PSUseConsistentIndentation double-indents attribute bodies that open a scriptblock (`[Attr({ … })]`) Open
Difficulty 3/5 1-2 days Newbie friendliness 70/100
PowerShell/PSScriptAnalyzer#2216 · 2 comments ·
-
Difficulty 3/5 1-2 days Newbie friendliness 68/100
PowerShell/PSScriptAnalyzer#2211 ·
-
`PSPlaceOpenBrace` and `PSPlaceCloseBrace` leave trailing whitespace when expanding one-line blocks Open
Difficulty 3/5 1-2 days Newbie friendliness 70/100
PowerShell/PSScriptAnalyzer#2210 ·
All issues in PowerShell/PSScriptAnalyzer
Similar issues
-
Status: Waiting triage Type: Bug
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
nanoframework/Home#1857 ·
-
kind/bug kind/regression
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
unoplatform/uno.toolkit.ui#1646 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
nightscout/nocturne#1379 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
elastic/esql-dotnet#47 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 85/100