PowerShell / PowerShell/PSScriptAnalyzer
PSAvoidUsingConvertToSecureStringWithPlainText makes unreasonable claims at high severity
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 2.2k
- Forks
- 414
- Avg merge
- 13h 1m
- Merged PRs (30d)
- 2
Description
Internal MS situation:
PSAvoidUsingConvertToSecureStringWithPlainText is now generating SFI/s360 work based on unsupported claims with neither Guardian nor TSA teams able to offer repo-wide suppression options.
This will expose secure information. Encrypted standard strings should be used instead.
Will it? Why is it an error?
I challenge you to create Credential instance from a token or another credential following this guidance.
There are workarounds of course and line-by-line suppressions, but they don't scale or make security story any stronger and we can't provide our own rules/settings for the linter.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the PSAvoidUsingConvertToSecureStringWithPlainText rule entry point and reviewing how its message and severity are defined. Compare those claims with the credential and token scenarios described in the issue; done means the rule's severity and guidance no longer make unsupported repo-wide security claims.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp, powershell
- Domain
- security, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100