Rule Request: `AvoidPlaintextParameterPasswords`

Similar to the rule AvoidUsingPlainTextForPassword, passing plaintext passwords to external/binary cmdlets should be avoided.

This includes cmdlets as e.g.:

PS C:\> Get-Command -ParameterName Password

CommandType     Name                                               Version    Source
-----------     ----                                               -------    ------
Function        Register-ScheduledTask                             1.0.0.0    ScheduledTasks
Function        Set-ScheduledTask                                  1.0.0.0    ScheduledTasks

But could potentially any imported (binary) cmdlet with a bound parameter named Password and of type String
Knowing that the AvoidUsingPlainTextForPassword rule might not capture the security risk when using a different variable name (e.g. -Password $Wachtwoord) or a password that is statically provided:

Invoke-ScriptAnalyzer -ScriptDefinition {
Set-ScheduledTask -TaskName 'SoftwareScan' -Trigger $Time -User 'User' -Password 'P@ssw0rd'
}.ToString()

Related:

• Rule request: AvoidSecureStringDisclosure #1997
• PowerShell issue: https://github.com/PowerShell/PowerShell/issues/26366 and https://github.com/PowerShell/PowerShell/issues/16502
• Document issue: https://github.com/MicrosoftDocs/windows-powershell-docs/issues/4051

まず、要求された動作を既存の AvoidUsingPlainTextForPassword ルールおよび issue 内の PowerShell の例と比較します。外部またはバイナリの cmdlet における Password という名前のバインドされた String パラメーターを、代替の変数名や静的な値も含めてどのように検出するかを定義し、作業完了と見なす前に、リンクされた issue を使用してスコープを確定します。