Rule Request: `AvoidPlaintextParameterPasswords`

Similar to the rule AvoidUsingPlainTextForPassword, passing plaintext passwords to external/binary cmdlets should be avoided.

This includes cmdlets as e.g.:

PS C:\> Get-Command -ParameterName Password

CommandType     Name                                               Version    Source
-----------     ----                                               -------    ------
Function        Register-ScheduledTask                             1.0.0.0    ScheduledTasks
Function        Set-ScheduledTask                                  1.0.0.0    ScheduledTasks

But could potentially any imported (binary) cmdlet with a bound parameter named Password and of type String
Knowing that the AvoidUsingPlainTextForPassword rule might not capture the security risk when using a different variable name (e.g. -Password $Wachtwoord) or a password that is statically provided:

Invoke-ScriptAnalyzer -ScriptDefinition {
Set-ScheduledTask -TaskName 'SoftwareScan' -Trigger $Time -User 'User' -Password 'P@ssw0rd'
}.ToString()

Related:

• Rule request: AvoidSecureStringDisclosure #1997
• PowerShell issue: https://github.com/PowerShell/PowerShell/issues/26366 and https://github.com/PowerShell/PowerShell/issues/16502
• Document issue: https://github.com/MicrosoftDocs/windows-powershell-docs/issues/4051

首先將要求的行為與現有的 AvoidUsingPlainTextForPassword 規則以及 issue 中的 PowerShell 範例進行比較。定義應如何偵測外部或二進位 cmdlet 上名為 Password 的已繫結 String 參數，包括替代變數名稱和靜態值，並使用相關的 issue 釐清範圍，之後再將工作視為完成。