-
Notifications
You must be signed in to change notification settings - Fork 8.1k
Closed
Labels
In-PRIndicates that a PR is out for the issueIndicates that a PR is out for the issueIssue-BugIssue has been identified as a bug in the productIssue has been identified as a bug in the productWG-NeedsReviewNeeds a review by the labeled Working GroupNeeds a review by the labeled Working GroupWG-Securitysecurity related areas such as JEAsecurity related areas such as JEA
Description
Prerequisites
- Write a descriptive title.
- Make sure you are able to repro it on the latest released version
- Search the existing issues.
- Refer to the FAQ.
- Refer to Differences between Windows PowerShell 5.1 and PowerShell.
Steps to reproduce
If I understand correctly, the new audit-only mode - despite technically reporting ConstrainedLanguage via $ExecutionContext.SessionState.LanguageMode - is meant to be a what-if constrained mode:
- In effect behave like
FullLanguageMode, but log operations that would be prevented ifConstrainedLanguagemode were actually enforced.
However, with respect to [pscustomobject] literals that isn't the case: Their use fails quietly:
#requires -RunAsAdministrator
# Simulate entering audit-only system lockdown
[Environment]::SetEnvironmentVariable("__PSLockdownPolicy", "0x80000008", 'Machine')
# Launch a new process that tries to use a [pscustomobject] literal
Start-Process -Wait pwsh '-NoProfile -C [pscustomobject] @{ foo = 1 } | Out-Host; pause'
# Turn lockdown back off
[Environment]::SetEnvironmentVariable("__PSLockdownPolicy", $null, 'Machine')The workaround is to simply execute $ExecutionContext.SessionState.LanguageMode = 'FullLanguage' in a session that was started in audit mode. (Is the ability to do so by design?)
However, even that doesn't work in other use cases: see
As an aside:
- Arguably,
[pscustomobject]literals should also work in trueConstrainedLanguagemode, but currently do not - seeConstrainedLanguagemode:[pscustomobject]literals cannot be used, even though the type is white-listed, and an equivalentNew-Objectcall succeeds #20767
Expected behavior
A [pscustomobject] instance should be constructed and output.
Actual behavior
No output, i.e. the expression fails quietly (but may be logged - haven't verified that).
Error details
No response
Environment data
PowerShell 7.4.0 on W11 22H2Visuals
No response
nightroman, ChristopherGLewis and ctolkien
Metadata
Metadata
Assignees
Labels
In-PRIndicates that a PR is out for the issueIndicates that a PR is out for the issueIssue-BugIssue has been identified as a bug in the productIssue has been identified as a bug in the productWG-NeedsReviewNeeds a review by the labeled Working GroupNeeds a review by the labeled Working GroupWG-Securitysecurity related areas such as JEAsecurity related areas such as JEA