Skip to content

Commit b28b84f

Browse files
author
dilanbhalla
committed
Merge branch 'main' of https://github.com/microsoft/codeql into auto/sync-main-pr
2 parents 9f44cb2 + 12db85a commit b28b84f

20 files changed

+227
-0
lines changed

‎powershell/ql/src/experimental/ConvertToSecureStringAsPlainText.qhelp

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
<overview>
6+
<p>The use of the AsPlainText parameter with the ConvertTo-SecureString command can expose secure information.</p>
7+
8+
</overview>
9+
<recommendation>
10+
<p>
11+
If you do need an ability to retrieve the password from somewhere without prompting the user, consider using the <a href="https://www.powershellgallery.com/packages/Microsoft.PowerShell.SecretStore">SecretStore</a> module from the PowerShell Gallery.
12+
</p>
13+
</recommendation>
14+
<references>
15+
16+
<li>
17+
PSScriptAnalyzer:
18+
<a href="https://learn.microsoft.com/en-us/powershell/utility-modules/psscriptanalyzer/rules/avoidusingconverttosecurestringwithplaintext?view=ps-modules">AvoidUsingConvertToSecureStringWithPlainText</a>.
19+
</li>
20+
21+
</references>
22+
</qhelp>

‎powershell/ql/src/experimental/ConvertToSecureStringAsPlainText.ql

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
/**
2+
* @name Use of the AsPlainText parameter in ConvertTo-SecureString
3+
* @description Do not use the AsPlainText parameter in ConvertTo-SecureString
4+
* @kind problem
5+
* @problem.severity error
6+
* @security-severity 7.0
7+
* @precision high
8+
* @id powershell/microsoft/public/convert-to-securestring-as-plaintext
9+
* @tags correctness
10+
* security
11+
*/
12+
13+
import powershell
14+
15+
from CmdCall c
16+
where
17+
c.getName() = "ConvertTo-SecureString" and
18+
c.hasNamedArgument("asplaintext")
19+
select c, "Use of AsPlainText parameter in ConvertTo-SecureString call"

‎powershell/ql/src/experimental/HardcodedComputerName.qhelp

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
<overview>
6+
<p>The names of computers should never be hard coded as this will expose sensitive information. The <code>ComputerName</code> parameter should never have a hard coded value.
7+
</p>
8+
9+
</overview>
10+
<recommendation>
11+
12+
<p>Remove hardcoded computer names.</p>
13+
14+
</recommendation>
15+
<references>
16+
17+
<li>
18+
PSScriptAnalyzer:
19+
<a href="https://learn.microsoft.com/en-us/powershell/utility-modules/psscriptanalyzer/rules/avoidusingcomputernamehardcoded?view=ps-modules">AvoidUsingComputerNameHardcoded</a>.
20+
</li>
21+
<!-- LocalWords: CWE untrusted unsanitized Runtime
22+
-->
23+
24+
</references>
25+
</qhelp>

‎powershell/ql/src/experimental/HardcodedComputerName.ql

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
/**
2+
* @name Hardcoded Computer Name
3+
* @description Do not hardcode computer names
4+
* @kind problem
5+
* @problem.severity error
6+
* @security-severity 7.0
7+
* @precision high
8+
* @id powershell/microsoft/public/hardcoded-computer-name
9+
* @tags correctness
10+
* security
11+
*/
12+
13+
import powershell
14+
15+
from Argument a
16+
where a.getName() = "computername" and exists(a.getValue())
17+
select a, "ComputerName argument is hardcoded to" + a.getValue()

‎powershell/ql/src/experimental/UseOfReservedCmdletChar.qhelp

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
<overview>
6+
<p>
7+
You cannot use following reserved characters in a function or cmdlet name as these can cause parsing or runtime errors.
8+
9+
Reserved Characters include: #,(){}[]&/\\$^;:\"'<>|?@`*%+=~
10+
</p>
11+
12+
</overview>
13+
<recommendation>
14+
15+
<p>Remove reserved characters from names.</p>
16+
17+
</recommendation>
18+
<references>
19+
20+
<li>
21+
PSScriptAnalyzer:
22+
<a href="https://learn.microsoft.com/en-us/powershell/utility-modules/psscriptanalyzer/rules/reservedcmdletchar?view=ps-modules">ReservedCmdletChar</a>.
23+
</li>
24+
25+
</references>
26+
</qhelp>

‎powershell/ql/src/experimental/UseOfReservedCmdletChar.ql

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
/**
2+
* @name Reserved Characters in Function Name
3+
* @description Do not use reserved characters in function names
4+
* @kind problem
5+
* @problem.severity error
6+
* @security-severity 7.0
7+
* @precision high
8+
* @id powershell/microsoft/public/reserved-characters-in-function-name
9+
* @tags correctness
10+
* security
11+
*/
12+
13+
import powershell
14+
15+
class ReservedCharacter extends string {
16+
ReservedCharacter() {
17+
this = [
18+
"!", "@", "#", "$",
19+
"&", "*", "(", ")",
20+
"+", "=", "{", "^",
21+
"}", "[", "]", "|",
22+
";", ":", "'", "\"",
23+
"<", ">", ",", "?",
24+
"/", "~"]
25+
}
26+
}
27+
28+
from Function f, ReservedCharacter r
29+
where f.getName().matches("%"+ r + "%")
30+
select f, "Function name contains a reserved character: " + r

‎powershell/ql/src/experimental/UsernameOrPasswordParameter.qhelp

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
<overview>
6+
<p>To standardize command parameters, credentials should be accepted as objects of type <code>PSCredential</code>. Functions should not make use of username or password parameters.
7+
</p>
8+
9+
</overview>
10+
<recommendation>
11+
12+
<p>Change the parameter to type <code>PSCredential</code>.</p>
13+
14+
</recommendation>
15+
<references>
16+
17+
18+
<li>
19+
PSScriptAnalyzer:
20+
<a href="https://learn.microsoft.com/en-us/powershell/utility-modules/psscriptanalyzer/rules/avoidusingusernameandpasswordparams?view=ps-modules">AvoidUsingUsernameAndPasswordParams</a>.
21+
</li>
22+
23+
</references>
24+
</qhelp>

‎powershell/ql/src/experimental/UsernameOrPasswordParameter.ql

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
/**
2+
* @name Use of Username or Password parameter
3+
* @description Do not use username or password parameters
4+
* @kind problem
5+
* @problem.severity error
6+
* @security-severity 7.0
7+
* @precision high
8+
* @id powershell/microsoft/public/username-or-password-parameter
9+
* @tags correctness
10+
* security
11+
*/
12+
13+
import powershell
14+
15+
from Parameter p
16+
where p.getName().toLowerCase() = ["username", "password"]
17+
select p, "Do not use username or password parameters."

‎powershell/ql/test/query-tests/security/ConvertToSecureStringAsPlainText/ConvertToSecureStringAsPlainText.expected

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
| test.ps1:2:19:2:79 | Call to ConvertTo-SecureString | Use of AsPlainText parameter in ConvertTo-SecureString call |

‎powershell/ql/test/query-tests/security/ConvertToSecureStringAsPlainText/ConvertToSecureStringAsPlainText.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
experimental/ConvertToSecureStringAsPlainText.ql

0 commit comments

Comments
 (0)