Rule Request: `AvoidPlaintextParameterPasswords`

Similar to the rule AvoidUsingPlainTextForPassword, passing plaintext passwords to external/binary cmdlets should be avoided.

This includes cmdlets as e.g.:

PS C:\> Get-Command -ParameterName Password

CommandType     Name                                               Version    Source
-----------     ----                                               -------    ------
Function        Register-ScheduledTask                             1.0.0.0    ScheduledTasks
Function        Set-ScheduledTask                                  1.0.0.0    ScheduledTasks

But could potentially any imported (binary) cmdlet with a bound parameter named Password and of type String
Knowing that the AvoidUsingPlainTextForPassword rule might not capture the security risk when using a different variable name (e.g. -Password $Wachtwoord) or a password that is statically provided:

Invoke-ScriptAnalyzer -ScriptDefinition {
Set-ScheduledTask -TaskName 'SoftwareScan' -Trigger $Time -User 'User' -Password 'P@ssw0rd'
}.ToString()

Related:

• Rule request: AvoidSecureStringDisclosure #1997
• PowerShell issue: https://github.com/PowerShell/PowerShell/issues/26366 and https://github.com/PowerShell/PowerShell/issues/16502
• Document issue: https://github.com/MicrosoftDocs/windows-powershell-docs/issues/4051

Comece comparando o comportamento solicitado com a regra existente AvoidUsingPlainTextForPassword e os exemplos de PowerShell na issue. Defina como os parâmetros String vinculados chamados Password em cmdlets externos ou binários devem ser detectados, incluindo nomes alternativos de variáveis e valores estáticos, e use as issues vinculadas para resolver o escopo antes de considerar o trabalho concluído.