mirrors/PowerShell
0
0
Fork 0
mirror of https://github.com/PowerShell/PowerShell.git synced 2024-11-23 09:43:57 +08:00
Code Issues Packages Projects Releases Wiki Activity

Disallow Add-Type in NoLanguage mode on a locked down machine (#16245)

Browse Source
This commit is contained in:
Travis Plunk 2021-10-14 14:53:41 -07:00 committed by GitHub
parent cd6eccb1ac
commit 3893c4d55b
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 40 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/Microsoft.PowerShell.Commands.Utility/commands/utility/AddType.cs
View File

@ -11,6 +11,7 @@ using System.IO;
using System.Linq;
using System.Management.Automation;
using System.Management.Automation.Internal;
using System.Management.Automation.Security;
using System.Reflection;
using System.Runtime.Loader;
using System.Security;
@ -549,8 +550,10 @@ namespace Microsoft.PowerShell.Commands
/// </summary>
protected override void BeginProcessing()
{
// Prevent code compilation in ConstrainedLanguage mode
if (SessionState.LanguageMode == PSLanguageMode.ConstrainedLanguage)
// Prevent code compilation in ConstrainedLanguage mode, or NoLanguage mode under system lock down.
if (SessionState.LanguageMode == PSLanguageMode.ConstrainedLanguage ||
(SessionState.LanguageMode == PSLanguageMode.NoLanguage &&
SystemPolicy.GetSystemLockdownPolicy() == SystemEnforcementMode.Enforce))
{
ThrowTerminatingError(
new ErrorRecord(

35
test/powershell/Modules/Microsoft.PowerShell.Security/ConstrainedLanguageRestriction.Tests.ps1
View File

@ -672,6 +672,41 @@ try
}
}
Describe "Add-Type in no language mode on locked down system" -Tags 'Feature','RequireAdminOnWindows' {
It "Verifies Add-Type fails in no language mode when in system lock down" {
# Create No-Language session, that allows Add-Type cmdlet
$entry = [System.Management.Automation.Runspaces.SessionStateCmdletEntry]::new('Add-Type', [Microsoft.PowerShell.Commands.AddTypeCommand], $null)
$iss = [initialsessionstate]::CreateRestricted([System.Management.Automation.SessionCapabilities]::Language)
$iss.Commands.Add($entry)
$rs = [runspacefactory]::CreateRunspace($iss)
$rs.Open()
# Try to use Add-Type in No-Language session
$ps = [powershell]::Create($rs)
$ps.AddCommand('Add-Type').AddParameter('TypeDefinition', 'public class C1 { }')
$expectedError = $null
try
{
Invoke-LanguageModeTestingSupportCmdlet -SetLockdownMode
$ps.Invoke()
}
catch
{
$expectedError = $_
}
finally
{
Invoke-LanguageModeTestingSupportCmdlet -RevertLockdownMode -EnableFullLanguageMode
$rs.Dispose()
$ps.Dispose()
}
$expectedError.Exception.InnerException.ErrorRecord.FullyQualifiedErrorId | Should -BeExactly 'CannotDefineNewType,Microsoft.PowerShell.Commands.AddTypeCommand'
}
}
Describe "Import-LocalizedData additional commands in constrained language" -Tags 'Feature','RequireAdminOnWindows' {
It "Verifies Import-LocalizedData disallows Add-Type in constrained language" {