Restrict New-Object in NoLanguage mode under lock down #14139 (#14140)

src/Microsoft.PowerShell.Commands.Utility/commands/utility/New-Object.cs

@@ -10,9 +10,7 @@ using System.Globalization;
 using System.Management.Automation;
 using System.Management.Automation.Internal;
 using System.Management.Automation.Language;
-#if !UNIX
 using System.Management.Automation.Security;
-#endif
 using System.Reflection;
 using System.Runtime.InteropServices;
 #if !UNIX
@@ -199,6 +197,25 @@ namespace Microsoft.PowerShell.Commands
                     }
                 }
 
+                switch (Context.LanguageMode)
+                {
+                    case PSLanguageMode.NoLanguage:
+                    case PSLanguageMode.RestrictedLanguage:
+                        if (SystemPolicy.GetSystemLockdownPolicy() == SystemEnforcementMode.Enforce
+                            && !CoreTypes.Contains(type))
+                        {
+                            ThrowTerminatingError(
+                                new ErrorRecord(
+                                    new PSNotSupportedException(
+                                        string.Format(NewObjectStrings.CannotCreateTypeLanguageMode, Context.LanguageMode.ToString())),
+                                    nameof(NewObjectStrings.CannotCreateTypeLanguageMode),
+                                    ErrorCategory.PermissionDenied,
+                                    targetObject: null));
+                        }
+
+                    break;
+                }
+
                 // WinRT does not support creating instances of attribute & delegate WinRT types.
                 if (WinRTHelper.IsWinRTType(type) && ((typeof(System.Attribute)).IsAssignableFrom(type) || (typeof(System.Delegate)).IsAssignableFrom(type)))
                 {

src/Microsoft.PowerShell.Commands.Utility/resources/NewObjectStrings.resx

@@ -144,6 +144,9 @@
   <data name="CannotCreateTypeConstrainedLanguage" xml:space="preserve">
     <value>Cannot create type. Only core types are supported in this language mode.</value>
   </data>
+  <data name="CannotCreateTypeLanguageMode" xml:space="preserve">
+    <value>Cannot create type. Only core types are supported in {0} language mode on a policy locked down machine.</value>
+  </data>
   <data name="ApartmentNotSupported" xml:space="preserve">
     <value>{0} Please note that Single-Threaded Apartment is not supported in PowerShell.</value>
   </data>