Skip to content

Commit 7359f91

Browse files
chanel-ychanel-y
committed
added initial psscriptanalyzer rules, docs, tests
1 parent c9b1356 commit 7359f91

18 files changed

+213
-0
lines changed

‎powershell/ql/src/experimental/HardcodedComputerName.qhelp

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
<overview>
6+
<p>The names of computers should never be hard coded as this will expose sensitive information. The ComputerName parameter should never have a hard coded value.
7+
</p>
8+
9+
</overview>
10+
<recommendation>
11+
12+
<p>Remove hardcoded computer names.</p>
13+
14+
</recommendation>
15+
<references>
16+
17+
<li>
18+
OWASP:
19+
<a href="https://www.owasp.org/index.php/Command_Injection">Command Injection</a>.
20+
</li>
21+
<li>
22+
PSScriptAnalyzer:
23+
<a href="https://learn.microsoft.com/en-us/powershell/utility-modules/psscriptanalyzer/rules/avoidusingcomputernamehardcoded?view=ps-modules">AvoidUsingComputerNameHardcoded</a>.
24+
</li>
25+
<!-- LocalWords: CWE untrusted unsanitized Runtime
26+
-->
27+
28+
</references>
29+
</qhelp>

‎powershell/ql/src/experimental/HardcodedComputerName.ql

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
/**
2+
* @name Hardcoded Computer Name
3+
* @description Using externally controlled strings in a command line may allow a malicious
4+
* user to change the meaning of the command.
5+
* @kind problem
6+
* @problem.severity error
7+
* @security-severity 9.8
8+
* @precision high
9+
* @id powershell/microsoft/public/command-injection
10+
* @tags correctness
11+
* security
12+
* external/cwe/cwe-078
13+
* external/cwe/cwe-088
14+
*/
15+
16+
import powershell
17+
18+
from Argument a
19+
where a.getName() = "computername" and exists(a.getValue())
20+
select a, "ComputerName argument is hardcoded to" + a.getValue()

‎powershell/ql/src/experimental/UseOfReservedCmdletChar.qhelp

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
<overview>
6+
<p>
7+
You cannot use following reserved characters in a function or cmdlet name as these can cause parsing or runtime errors.
8+
9+
Reserved Characters include: #,(){}[]&/\\$^;:\"'<>|?@`*%+=~
10+
</p>
11+
12+
</overview>
13+
<recommendation>
14+
15+
<p>Remove reserved characters from names.</p>
16+
17+
</recommendation>
18+
<references>
19+
20+
<li>
21+
OWASP:
22+
<a href="https://www.owasp.org/index.php/Command_Injection">Command Injection</a>.
23+
</li>
24+
<li>
25+
PSScriptAnalyzer:
26+
<a href="https://learn.microsoft.com/en-us/powershell/utility-modules/psscriptanalyzer/rules/reservedcmdletchar?view=ps-modules">ReservedCmdletChar</a>.
27+
</li>
28+
<!-- LocalWords: CWE untrusted unsanitized Runtime
29+
-->
30+
31+
</references>
32+
</qhelp>

‎powershell/ql/src/experimental/UseOfReservedCmdletChar.ql

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
/**
2+
* @name Hardcoded Computer Name
3+
* @description Using externally controlled strings in a command line may allow a malicious
4+
* user to change the meaning of the command.
5+
* @kind problem
6+
* @problem.severity error
7+
* @security-severity 9.8
8+
* @precision high
9+
* @id powershell/microsoft/public/command-injection
10+
* @tags correctness
11+
* security
12+
* external/cwe/cwe-078
13+
* external/cwe/cwe-088
14+
*/
15+
16+
import powershell
17+
18+
class ReservedCharacter extends string {
19+
ReservedCharacter() {
20+
this = [
21+
"!", "@", "#", "$",
22+
"&", "*", "(", ")",
23+
"+", "=", "{", "^",
24+
"}", "[", "]", "|",
25+
";", ":", "'", "\"",
26+
"<", ">", ",", "?",
27+
"/", "~"]
28+
}
29+
}
30+
31+
from Function f, ReservedCharacter r
32+
where f.getName().matches("%"+ r + "%")
33+
select f, "Function name contains a reserved character: " + r

‎powershell/ql/src/experimental/UsernameOrPasswordParameter.qhelp

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
<overview>
6+
<p>To standardize command parameters, credentials should be accepted as objects of type PSCredential. Functions should not make use of username or password parameters.
7+
</p>
8+
9+
</overview>
10+
<recommendation>
11+
12+
<p>Change the parameter to type PSCredential.</p>
13+
14+
</recommendation>
15+
<references>
16+
17+
<li>
18+
OWASP:
19+
<a href="https://www.owasp.org/index.php/Command_Injection">Command Injection</a>.
20+
</li>
21+
<li>
22+
PSScriptAnalyzer:
23+
<a href="https://learn.microsoft.com/en-us/powershell/utility-modules/psscriptanalyzer/rules/avoidusingusernameandpasswordparams?view=ps-modules">AvoidUsingUsernameAndPasswordParams</a>.
24+
</li>
25+
<!-- LocalWords: CWE untrusted unsanitized Runtime
26+
-->
27+
28+
</references>
29+
</qhelp>

‎powershell/ql/src/experimental/UsernameOrPasswordParameter.ql

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
/**
2+
* @name Hardcoded Computer Name
3+
* @description Using externally controlled strings in a command line may allow a malicious
4+
* user to change the meaning of the command.
5+
* @kind problem
6+
* @problem.severity error
7+
* @security-severity 9.8
8+
* @precision high
9+
* @id powershell/microsoft/public/command-injection
10+
* @tags correctness
11+
* security
12+
* external/cwe/cwe-078
13+
* external/cwe/cwe-088
14+
*/
15+
16+
import powershell
17+
18+
// from Expr e
19+
// where e.getLocation().getFile().getBaseName() = "AvoidUsingUsernameAndPasswordParams.ps1"
20+
// select e, e.getAQlClass()
21+
22+
from Parameter p
23+
where p.getName().toLowerCase() = ["username", "password"]
24+
select p, "Do not use username or password parameters."

‎powershell/ql/test/query-tests/security/ConvertToSecureStringAsPlainText/ConvertToSecureStringAsPlainText.expected

Whitespace-only changes.

‎powershell/ql/test/query-tests/security/ConvertToSecureStringAsPlainText/ConvertToSecureStringAsPlainText.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
experimental/ConvertToSecureStringAsPlainText.ql

‎powershell/ql/test/query-tests/security/ConvertToSecureStringAsPlainText/test.ps1

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
$UserInput = Read-Host 'Please enter your secure code'
2+
$EncryptedInput = ConvertTo-SecureString -String $UserInput -AsPlainText -Force
3+
4+
$SecureUserInput = Read-Host 'Please enter your secure code' -AsSecureString

‎powershell/ql/test/query-tests/security/HardcodedComputerName/HardcodedComputerName.expected

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
| test.ps1:3:44:3:65 | hardcoderemotehostname | ComputerName argument is hardcoded tohardcoderemotehostname |
2+
| test.ps1:13:44:13:64 | hardcodelocalhostname | ComputerName argument is hardcoded tohardcodelocalhostname |

0 commit comments

Comments
 (0)