PowerShell / PowerShell/PSScriptAnalyzer
Any variable containing the word "credit" triggers PSAvoidUsingPlainTextForPassword
Open
Nobody has claimed this yet.
Area - Rules
Issue - Enhancement
Up for Grabs
- Dominant language
- C#
- Stars
- 2.2k
- Forks
- 414
- Avg merge
- 13h 1m
- Merged PRs (30d)
- 2
Description
Steps to reproduce
Invoke-ScriptAnalyzer -IncludeSuppressed -ScriptDefinition 'Param([string] $creditor = ""); Write-Information $creditor'
Expected behavior
(no output)
Actual behavior
RuleName Severity ScriptName Line Message
-------- -------- ---------- ---- -------
PSAvoidUsingPlainTextForPassword Warning 1 Parameter '$creditor' should not use String type but either
SecureString or PSCredential, otherwise it increases the
chance to to expose this sensitive information.
Environment data
> $PSVersionTable
Name Value
---- -----
PSVersion 7.3.2
PSEdition Core
GitCommitId 7.3.2
OS Microsoft Windows 10.0.19044
Platform Win32NT
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
> (Get-Module -ListAvailable PSScriptAnalyzer).Version | ForEach-Object { $_.ToString() }
1.21.0
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the PowerShell example and locating the implementation of PSAvoidUsingPlainTextForPassword. Trace why the parameter name "$creditor" is classified as sensitive; done means avoiding this false positive while preserving detection of actual plain-text password parameters.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- powershell
- Domain
- security, tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100