Skip to content

Redact targetName passed to remote prompt if it potentially includes PowerShellCode #28378

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Ryan Yates (kilasuit) wants to merge 9 commits into
base: master
Choose a base branch
from
+42 −8
Draft

Redact targetName passed to remote prompt if it potentially includes PowerShellCode #28378

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
f62ef76
add internal RedactIfPowerShellCode method
kilasuit Nov 8, 2026
431b029
add SMA.Language to using statement
kilasuit Nov 8, 2026
623dca0
Call RedactIfPowerShellCode method and use output from it in the prompt
kilasuit Nov 8, 2026
d12d5e3
remove additional whitespace in L67->L69
kilasuit Nov 8, 2026
5a5a20d
Simplify Logic in RedactIfPowerShellCode internal method
kilasuit Nov 8, 2026
79c1e51
Escape the targetName post redaction step & single quote the prompt
kilasuit Nov 11, 2026
f9aae6e
Add Comment
kilasuit Nov 11, 2026
9f40dbb
Update comment and add warning message and resource string
kilasuit Nov 11, 2026
b37a9f2
Spelling is hard
kilasuit Nov 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
47 changes: 39 additions & 8 deletions src/System.Management.Automation/engine/remoting/commands/PushRunspaceCommand.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@
using System.Management.Automation;
using System.Management.Automation.Host;
using System.Management.Automation.Internal;
using System.Management.Automation.Language;
using System.Management.Automation.Remoting;
using System.Management.Automation.Runspaces;
using System.Threading;
Expand Down Expand Up @@ -63,9 +64,9 @@ public class EnterPSSessionCommand : PSRemotingBaseCmdlet
/// </summary>
[Parameter(ParameterSetName = PSRemotingBaseCmdlet.SSHHostParameterSet)]
[ValidateNotNullOrEmpty]
public override Hashtable Options
{
get
public override Hashtable Options
{
get
{
return base.Options;
}
Expand Down Expand Up @@ -1174,12 +1175,21 @@ private void SetRunspacePrompt(RemoteRunspace remoteRunspace)
Dbg.Assert(false, "Unrecognized parameter set.");
break;
}

// Check if the remoteRunspace targetName contains potentially unwanted PowerShell code, test this against an allowed list of commonly used PowerShell code that doesn't pose a security risk and redact it if necessary, omitting a Warning message if the targetName is redacted.
string targetNameRedacted = RedactIfPowerShellCode(targetName);
if (!string.Equals(targetName, targetNameRedacted, StringComparison.Ordinal))
{
WriteWarning(
StringUtil.Format(
RemotingErrorIdStrings.RemotePromptTargetNameRedacted,
targetName,
targetNameRedacted));
}
string escapedTargetName = CodeGeneration.EscapeSingleQuotedStringContent(targetNameRedacted);
string promptFn = StringUtil.Format(RemotingErrorIdStrings.EnterVMSessionPrompt,
@"function global:prompt { """,
targetName,
@"PS $($executionContext.SessionState.Path.CurrentLocation)> "" }");

@"function global:prompt { '",
escapedTargetName,
@"PS ' + $executionContext.SessionState.Path.CurrentLocation + '> ' }");
// Set prompt in pushed named pipe runspace.
using (System.Management.Automation.PowerShell ps = System.Management.Automation.PowerShell.Create())
{
Expand Down Expand Up @@ -1395,6 +1405,27 @@ internal static void ContinueCommand(RemoteRunspace remoteRunspace, Pipeline cmd
}
}

internal static string RedactIfPowerShellCode(string input)
{
if (string.IsNullOrEmpty(input))
{
return input;
}

bool startsWithOrContainsDangerousToken =
input.StartsWith('$') ||
input.StartsWith("@{") ||
input.StartsWith('(') ||
input.StartsWith('"') ||
input.StartsWith('@') ||
input.StartsWith('\'') ||
input.Contains('$');

return startsWithOrContainsDangerousToken
? "REDACTED"
: input;
}

#endregion
}
}
3 changes: 3 additions & 0 deletions src/System.Management.Automation/resources/RemotingErrorIdStrings.resx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1734,4 +1734,7 @@ SSH client process terminated before connection could be established.</value>
<data name="HyperVNegotiationFailed" xml:space="preserve">
<value>Negotiating a secure connection to Hyper-V failed. Make sure the Host and Guest are updated with all relevant Microsoft Updates.</value>
</data>
<data name="RemotePromptTargetNameRedacted" xml:space="preserve">
<value>The following prompt Target Name '{0}' has been redacted to '{1}' for security reasons.</value>
</data>
</root>