Skip to content

Commit 6cfc260

Browse files
joshcorrjoshcorr
authored
Add Optional PSUseConstrainedLanguageMode rule (#2165)
* Add UseConstrainedLanguageMode rule and tests * Enhance CLM rule: restrict types, COM objects, add tests * Enhance detection of disallowed types in CLM rule * Detect and flag class definitions in Constrained Language * Enhance CLM rule to check module manifests for wildcards/.ps1 * Differentiate CLM checks for signed vs unsigned scripts * Improve dot-sourcing detection and expand CLM rule tests * Add IgnoreSignatures option to CLM rule and improve type checks * Add documentation for PSUseConstrainedLanguageMode rule * Increase severity of UseConstrainedLanguageMode to Warning for optional rule * Update test to expect 'Warning' severity instead of 'Info' * Making copilot suggested edits * Detect and flag [PSCustomObject]@{} in CLM scripts * Add UseConstrainedLanguageMode rule to README.md * Update CLM rule: tighten types, docs, and add error string * Add platform checks to CLM tests for cross-platform support * Add missing end tag after merge conflict from main * Add CLM rule ScriptsToProcess; Fix wildcard and dotsource bug
1 parent 6883618 commit 6cfc260

File tree

5 files changed

+2398
-0
lines changed

5 files changed

+2398
-0
lines changed

‎Rules/Strings.resx‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1263,6 +1263,60 @@
12631263
<data name="AvoidReservedWordsAsFunctionNamesError" xml:space="preserve">
12641264
<value>The reserved word '{0}' was used as a function name. This should be avoided.</value>
12651265
</data>
1266+
<data name="UseConstrainedLanguageModeName" xml:space="preserve">
1267+
<value>UseConstrainedLanguageMode</value>
1268+
</data>
1269+
<data name="UseConstrainedLanguageModeCommonName" xml:space="preserve">
1270+
<value>Consider Constrained Language Mode Restrictions</value>
1271+
</data>
1272+
<data name="UseConstrainedLanguageModeDescription" xml:space="preserve">
1273+
<value>Identifies script patterns that are restricted in Constrained Language Mode. Constrained Language Mode limits the types, cmdlets, and .NET methods that can be used to help secure PowerShell in environments requiring additional restrictions.</value>
1274+
</data>
1275+
<data name="UseConstrainedLanguageModeAddTypeError" xml:space="preserve">
1276+
<value>Add-Type is not permitted in Constrained Language Mode. Consider alternative approaches if this script will run in a restricted environment.</value>
1277+
</data>
1278+
<data name="UseConstrainedLanguageModeComObjectError" xml:space="preserve">
1279+
<value>New-Object with the COM object '{0}' is not permitted in Constrained Language Mode. Consider alternative approaches if this script will run in a restricted environment.</value>
1280+
</data>
1281+
<data name="UseConstrainedLanguageModeXamlError" xml:space="preserve">
1282+
<value>XAML usage is not permitted in Constrained Language Mode. Consider alternative approaches if this script will run in a restricted environment.</value>
1283+
</data>
1284+
<data name="UseConstrainedLanguageModeDotSourceError" xml:space="preserve">
1285+
<value>Dot-sourcing may be restricted in Constrained Language Mode depending on the source location. Ensure scripts are from trusted locations if running in a restricted environment.</value>
1286+
</data>
1287+
<data name="UseConstrainedLanguageModeInvokeExpressionError" xml:space="preserve">
1288+
<value>Invoke-Expression is restricted in Constrained Language Mode. Consider alternative approaches if this script will run in a restricted environment.</value>
1289+
</data>
1290+
<data name="UseConstrainedLanguageModeNewObjectError" xml:space="preserve">
1291+
<value>New-Object with type '{0}' is not permitted in Constrained Language Mode. Consider using an allowed type.</value>
1292+
</data>
1293+
<data name="UseConstrainedLanguageModeConstrainedTypeError" xml:space="preserve">
1294+
<value>Type constraint [{0}] is not permitted in Constrained Language Mode. Consider using an allowed type.</value>
1295+
</data>
1296+
<data name="UseConstrainedLanguageModeTypeExpressionError" xml:space="preserve">
1297+
<value>Type expression [{0}] is not permitted in Constrained Language Mode. Consider using an allowed type.</value>
1298+
</data>
1299+
<data name="UseConstrainedLanguageModeConvertExpressionError" xml:space="preserve">
1300+
<value>Type cast [{0}] is not permitted in Constrained Language Mode. Consider using an allowed type.</value>
1301+
</data>
1302+
<data name="UseConstrainedLanguageModeMemberAccessError" xml:space="preserve">
1303+
<value>Member '{1}' accessed on type [{0}] which is not permitted in Constrained Language Mode. Consider using an allowed type.</value>
1304+
</data>
1305+
<data name="UseConstrainedLanguageModeClassError" xml:space="preserve">
1306+
<value>PowerShell class '{0}' is not permitted in Constrained Language Mode. Consider using alternative approaches such as hashtables or PSCustomObject.</value>
1307+
</data>
1308+
<data name="UseConstrainedLanguageModeWildcardExportError" xml:space="preserve">
1309+
<value>Module manifest field '{0}' uses wildcard ('*') which is not recommended for Constrained Language Mode. Explicitly list exported items instead.</value>
1310+
</data>
1311+
<data name="UseConstrainedLanguageModeScriptModuleError" xml:space="preserve">
1312+
<value>Module manifest field '{0}' contains script file '{1}' (.ps1). Use a module file (.psm1) or a binary module (.dll) instead for Constrained Language Mode compatibility.</value>
1313+
</data>
1314+
<data name="UseConstrainedLanguageModeScriptsToProcessError" xml:space="preserve">
1315+
<value>Module manifest field 'ScriptsToProcess' contains script file '{0}' (.ps1). Scripts in ScriptsToProcess run in the caller's session state and are restricted in Constrained Language Mode. Consider moving this logic to module initialization code</value>
1316+
</data>
1317+
<data name="UseConstrainedLanguageModePSCustomObjectError" xml:space="preserve">
1318+
<value>[PSCustomObject]@{{}} syntax is not permitted in Constrained Language Mode. Use New-Object PSObject -Property @{{}} or plain hashtables instead.</value>
1319+
</data>
12661320
<data name="UseSingleValueFromPipelineParameterCommonName" xml:space="preserve">
12671321
<value>Use a single ValueFromPipeline parameter per parameter set</value>
12681322
</data>

0 commit comments

Comments
 (0)