PSAvoidUsingConvertToSecureStringWithPlainText makes unreasonable claims at high severity
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
Research direction
Start by locating the PSAvoidUsingConvertToSecureStringWithPlainText rule entry point and reviewing how its message and severity are defined. Compare those claims with the credential and token scenarios described in the issue; done means the rule's severity and guidance no longer make unsupported repo-wide security claims.
Written by the indexing model from the issue text.
Description
Internal MS situation:
PSAvoidUsingConvertToSecureStringWithPlainText is now generating SFI/s360 work based on unsupported claims with neither Guardian nor TSA teams able to offer repo-wide suppression options.
This will expose secure information. Encrypted standard strings should be used instead.
Will it? Why is it an error?
I challenge you to create Credential instance from a token or another credential following this guidance.
There are workarounds of course and line-by-line suppressions, but they don't scale or make security story any stronger and we can't provide our own rules/settings for the linter.
- Dominant language
- C#
- Stars
- 2.2k
- Forks
- 415
- Avg merge
- 13h 1m
- Merged PRs (30d)
- 2
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from PowerShell/PSScriptAnalyzer
-
Up-for-Grabs
Difficulty 1/5 1-3 hours Newbie friendliness 78/100
PowerShell/PSScriptAnalyzer#2213 · 2 comments ·
-
Difficulty 3/5 1-2 days Newbie friendliness 72/100
PowerShell/PSScriptAnalyzer#2217 · 1 comment ·
-
PSUseConsistentIndentation double-indents attribute bodies that open a scriptblock (`[Attr({ … })]`) Open
Difficulty 3/5 1-2 days Newbie friendliness 70/100
PowerShell/PSScriptAnalyzer#2216 · 2 comments ·
-
Difficulty 3/5 1-2 days Newbie friendliness 68/100
PowerShell/PSScriptAnalyzer#2211 ·
-
`PSPlaceOpenBrace` and `PSPlaceCloseBrace` leave trailing whitespace when expanding one-line blocks Open
Difficulty 3/5 1-2 days Newbie friendliness 70/100
PowerShell/PSScriptAnalyzer#2210 ·
All issues in PowerShell/PSScriptAnalyzer
Similar issues
-
Status: Waiting triage Type: Bug
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
nanoframework/Home#1857 ·
-
kind/bug kind/regression
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
unoplatform/uno.toolkit.ui#1646 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
nightscout/nocturne#1379 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
elastic/esql-dotnet#47 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 85/100