From b007952f74b05370496c6e6cdf46af2df92220e7 Mon Sep 17 00:00:00 2001
From: krishnayalavarthi <krishnaprasad.y@gmail.com>
Date: Tue, 8 Dec 2020 14:45:38 -0800
Subject: [PATCH] Restrict New-Object in NoLanguage mode under lock down #14139
 (#14140)

---
 .../commands/utility/New-Object.cs            | 21 +++++++++++++++++--
 .../resources/NewObjectStrings.resx           |  3 +++
 2 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/src/Microsoft.PowerShell.Commands.Utility/commands/utility/New-Object.cs b/src/Microsoft.PowerShell.Commands.Utility/commands/utility/New-Object.cs
index 3f02ffcfb..54e323dfa 100644
--- a/src/Microsoft.PowerShell.Commands.Utility/commands/utility/New-Object.cs
+++ b/src/Microsoft.PowerShell.Commands.Utility/commands/utility/New-Object.cs
@@ -10,9 +10,7 @@ using System.Globalization;
 using System.Management.Automation;
 using System.Management.Automation.Internal;
 using System.Management.Automation.Language;
-#if !UNIX
 using System.Management.Automation.Security;
-#endif
 using System.Reflection;
 using System.Runtime.InteropServices;
 #if !UNIX
@@ -199,6 +197,25 @@ namespace Microsoft.PowerShell.Commands
                     }
                 }
 
+                switch (Context.LanguageMode)
+                {
+                    case PSLanguageMode.NoLanguage:
+                    case PSLanguageMode.RestrictedLanguage:
+                        if (SystemPolicy.GetSystemLockdownPolicy() == SystemEnforcementMode.Enforce
+                            && !CoreTypes.Contains(type))
+                        {
+                            ThrowTerminatingError(
+                                new ErrorRecord(
+                                    new PSNotSupportedException(
+                                        string.Format(NewObjectStrings.CannotCreateTypeLanguageMode, Context.LanguageMode.ToString())),
+                                    nameof(NewObjectStrings.CannotCreateTypeLanguageMode),
+                                    ErrorCategory.PermissionDenied,
+                                    targetObject: null));
+                        }
+
+                    break;
+                }
+
                 // WinRT does not support creating instances of attribute & delegate WinRT types.
                 if (WinRTHelper.IsWinRTType(type) && ((typeof(System.Attribute)).IsAssignableFrom(type) || (typeof(System.Delegate)).IsAssignableFrom(type)))
                 {
diff --git a/src/Microsoft.PowerShell.Commands.Utility/resources/NewObjectStrings.resx b/src/Microsoft.PowerShell.Commands.Utility/resources/NewObjectStrings.resx
index 63b4271c3..07c2a6d8c 100644
--- a/src/Microsoft.PowerShell.Commands.Utility/resources/NewObjectStrings.resx
+++ b/src/Microsoft.PowerShell.Commands.Utility/resources/NewObjectStrings.resx
@@ -144,6 +144,9 @@
   <data name="CannotCreateTypeConstrainedLanguage" xml:space="preserve">
     <value>Cannot create type. Only core types are supported in this language mode.</value>
   </data>
+  <data name="CannotCreateTypeLanguageMode" xml:space="preserve">
+    <value>Cannot create type. Only core types are supported in {0} language mode on a policy locked down machine.</value>
+  </data>
   <data name="ApartmentNotSupported" xml:space="preserve">
     <value>{0} Please note that Single-Threaded Apartment is not supported in PowerShell.</value>
   </data>