Add the xsd validation back for CIM cmdlets - #27869
Merged
Dongbo Wang (daxian-dbw) merged 1 commit intoAug 20, 2026
Merged
Conversation
Anam Navied (anamnavi)
requested review from
a team and
Justin Chung (jshigetomi)
as code owners
August 20, 2026 15:39
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
Anam Navied (anamnavi)
force-pushed
the
cim_validation
branch
from
August 20, 2026 15:49
0444015 to
47d7a92
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
This pull request restores and hardens CDXML schema validation for CIM cmdlets by embedding the cmdlets-over-objects.xsd schema into System.Management.Automation, updating ScriptWriter to load the schema from the embedded resource, and adding a regression test to ensure malformed CDXML is rejected.
Changes:
- Embed
cmdlets-over-objects.xsdintoSystem.Management.Automationand load it viaGetManifestResourceStreamfor schema validation. - Refactor
ScriptWriterXML reader settings to consistently enable schema validation. - Add a CDXML test asset and a Pester test to validate rejection of an injected
Verbattribute.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| test/powershell/engine/Cdxml/Cdxml.Tests.ps1 | Adds a regression test to ensure CDXML import rejects injected/malformed Verb values. |
| test/powershell/engine/Cdxml/assets/invalid_verb/invalid_verb.cdxml | Adds a malicious/invalid CDXML asset used by the new regression test. |
| src/System.Management.Automation/System.Management.Automation.csproj | Embeds cmdlets-over-objects.xsd as an assembly resource for runtime availability. |
| src/System.Management.Automation/cimSupport/cmdletization/ScriptWriter.cs | Loads the embedded XSD and configures XML schema validation for cmdletization metadata. |
| src/Microsoft.PowerShell.Commands.Management/resources/CmdletizationResources.resx | Removes an explicit System.Windows.Forms assembly alias entry from the RESX. |
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+56
to
+61
| using Stream xsdStream = typeof(ScriptWriter).Assembly.GetManifestResourceStream("cmdlets-over-objects.xsd"); | ||
| XmlReader cmdletizationSchemaReader = XmlReader.Create(xsdStream, s_xmlReaderSettings); | ||
|
|
||
| s_xmlReaderSettings.Schemas = new XmlSchemaSet(); | ||
| s_xmlReaderSettings.Schemas.Add(null, cmdletizationSchemaReader); | ||
| s_xmlReaderSettings.Schemas.XmlResolver = null; // do not fetch external documents |
There was a problem hiding this comment.
This is not necessary. It's better to add a test to make sure the embedded resource is available.
I will add the test in a separate PR.
Travis Plunk (TravisEz13)
approved these changes
Aug 20, 2026
Anam Navied (anamnavi)
force-pushed
the
cim_validation
branch
from
August 20, 2026 15:57
47d7a92 to
fae6f87
Compare
Travis Plunk (TravisEz13)
added
CL-General
Dongbo Wang (daxian-dbw)
approved these changes
Aug 20, 2026
Dongbo Wang (daxian-dbw)
merged commit Aug 20, 2026
ad9c8fb
into
PowerShell:master
39 of 41 checks passed
Merged
9 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR Summary
This pull request improves the security and reliability of CDXML cmdlet XML schema validation in PowerShell. The main changes include embedding the
cmdlets-over-objects.xsdschema as a resource, updating the XML schema validation logic to use this embedded resource, and adding a test to ensure that XML is valid.Schema validation improvements:
cmdlets-over-objects.xsdXML schema file is now embedded as a resource in theSystem.Management.Automationassembly, ensuring it is always available at runtime and not dependent on external files.ScriptWriterinScriptWriter.csis refactored to load the embedded schema resource for XML validation, replacing the previous approach that relied on resource strings and conditional compilation. This ensures proper schema validation and improved security.Testing:
Cdxml.Tests.ps1to verify that attempts to use invalid schema via theVerbattribute in a CDXML file are correctly blocked.Minor cleanup:
System.Windows.Formsassembly reference is removed fromCmdletizationResources.resx.PR Context
PR Checklist
.h,.cpp,.cs,.ps1and.psm1files have the correct copyright header