<!-- Anything that looks like this is a comment and can't be seen after the Pull Request is created. -->
# PR Summary
Web commands currently preserve `Authorization` headers when either the `FollowRelLinks` parameter or the `PreserveHttpMethodOnRedirect` parameter is specified. This should only occur when `PreserveAuthorizationOnRedirect` is specified. This change fixes that.
<!-- Summarize your PR between here and the checklist. -->
## PR Context
<!-- Provide a little reasoning as to why this Pull Request helps and why you have opened it. -->
## PR Checklist
- [x] [PR has a meaningful title](https://github.com/PowerShell/PowerShell/blob/master/.github/CONTRIBUTING.md#pull-request---submission)
- Use the present tense and imperative mood when describing your changes
- [x] [Summarized changes](https://github.com/PowerShell/PowerShell/blob/master/.github/CONTRIBUTING.md#pull-request---submission)
- [x] [Make sure all `.h`, `.cpp`, `.cs`, `.ps1` and `.psm1` files have the correct copyright header](https://github.com/PowerShell/PowerShell/blob/master/.github/CONTRIBUTING.md#pull-request---submission)
- [x] This PR is ready to merge. If this PR is a work in progress, please open this as a [Draft Pull Request and mark it as Ready to Review when it is ready to merge](https://docs.github.com/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/about-pull-requests#draft-pull-requests).
- **[Breaking changes](https://github.com/PowerShell/PowerShell/blob/master/.github/CONTRIBUTING.md#making-breaking-changes)**
- [ ] None
- **OR**
- [x] This is a breaking change, but cannot be made experimental.
- [ ] [Experimental feature(s) needed](https://github.com/MicrosoftDocs/PowerShell-Docs/blob/main/reference/7.5/Microsoft.PowerShell.Core/About/about_Experimental_Features.md)
- [ ] Experimental feature name(s): <!-- Experimental feature name(s) here -->
- **User-facing changes**
- [ ] Not Applicable
- **OR**
- [x] [Documentation needed](https://github.com/PowerShell/PowerShell/blob/master/.github/CONTRIBUTING.md#pull-request---submission)
- [ ] Issue filed: <!-- Number/link of that issue here -->
- **Testing - New and feature**
- [ ] N/A or can only be tested interactively
- **OR**
- [x] [Make sure you've added a new test if existing tests do not effectively test the code changed](https://github.com/PowerShell/PowerShell/blob/master/.github/CONTRIBUTING.md#before-submitting)
----
#### AI description (iteration 1)
#### PR Classification
Security fix to change default behavior of web cmdlets to strip authorization headers on redirects, requiring explicit opt-in to preserve them.
#### PR Summary
This PR addresses a security issue by changing the default behavior of `Invoke-WebRequest` and `Invoke-RestMethod` to strip authorization headers when following redirects, unless the `-PreserveAuthorizationOnRedirect` parameter is explicitly specified.
- `WebRequestPSCmdlet.Common.cs`: Modifi...
Update MaxVisitCount and MaxHashtableKeyCount if visitor safe value context indicates SkipLimitCheck is true
Related work items: #163537
----
#### AI description (iteration 1)
#### PR Classification
Enhancement: Conditionally update AST limit checks based on safe value context flags.
#### PR Summary
This pull request refactors the safe value visitor to initialize runtime limit values, setting them to maximum if the `SkipLimitCheck` flag is present, and adjusts the corresponding condition checks to support larger AST structures safely.
- `src/System.Management.Automation/engine/parser/SafeValues.cs`: Replaced hard-coded limit constants with runtime-initialized readonly fields based on the safe value context, and updated conditional checks in `IsAstSafe` and `VisitHashtable`.
- `test/powershell/Modules/Microsoft.PowerShell.Utility/PowerShellData.tests.ps1`: Added tests to validate behavior when using `-SkipLimitCheck`, ensuring insecure PSD1 files are properly rejected.
<!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
Related work items: #163537
* Add support to `Get-Error` to handle BoundParameters
* sort the keys
* change to generalize for all dictionaries
* address Patrick's comment to generalize and use one codepath for dictionaries
* address codefactor
* add tests
* fix formatting issues
* Make redirection to variable an experimental feature.
Update test to check for experimental feature status.
Set-Variable will still have the -append parameter, but if used when the experimental feature is disabled, a parameter binding error will result.
* Check to be sure provider is not null.
* update to use different FullyQualifiedErrorId
* use Experimental attribute for append parameter rather than runtime check.
* Revert "update to use different FullyQualifiedErrorId"
This reverts commit 8b34af1ac19ecdb821b34534e446ab129830c92f.
* Update src/Microsoft.PowerShell.Commands.Utility/commands/utility/Var.cs
Co-authored-by: Ilya <darpa@yandex.ru>
* Move remediation steps into resource.
Update Set-Variable -Append to be correct when -name and -value are used.
Add tests for the new behavior in Set-Variable.
* Change expected error for contrained language mode and redirection.
* Update src/Microsoft.PowerShell.Commands.Utility/commands/utility/Var.cs
Co-authored-by: Ilya <darpa@yandex.ru>
* Support redirection of native app.
Add tests to validate.
* testexe needs proper case to run on linux.
* Address codefactor issues 01.
* Update src/System.Management.Automation/engine/runtime/Operations/MiscOps.cs
Co-authored-by: Steve Lee <slee@microsoft.com>
* Update src/Microsoft.PowerShell.Commands.Utility/commands/utility/Var.cs
Co-authored-by: Steve Lee <slee@microsoft.com>
* Update src/System.Management.Automation/engine/runtime/Operations/MiscOps.cs
Co-authored-by: Steve Lee <slee@microsoft.com>
---------
Co-authored-by: Ilya <darpa@yandex.ru>
Co-authored-by: Steve Lee <slee@microsoft.com>
Adds the -DateKind parameter to the ConvertFrom-Json that allows the
caller to control how DateTime strings are converted into an object. The
default behaviour is to create a DateTime value with the Kind being
Unspecified if no TZ is set, Utc if the TZ Z is set, Local (after
conversion) if an explicit TZ is set. This adds a Utc, Local to
explicitly set the Kind as desired as well as a Offset and String value
to create a DateTimeOffset or keep as a string.
Updates the Test-Json cmdlet to use JsonSchema.Net instead of NJsonSchema in order to:
- use System.Text.Json instead of Newtonsoft
- support the latest JSON Schema drafts (up to 2020-12)
* Added SkipLast parameter set to Skip parameter and updated tests
* Using Should -BeExactly with string
* Update test/powershell/Modules/Microsoft.PowerShell.Utility/Select-Object.Tests.ps1
---------
Co-authored-by: Travis Plunk <travis.plunk@microsoft.com>
Co-authored-by: Travis Plunk <github@ez13.net>
* Add `Get-SecureRandom` cmdlet
* update comments
* address Paul and Travis' comments
* Update test/powershell/Modules/Microsoft.PowerShell.Utility/Get-SecureRandom.Tests.ps1
Co-authored-by: James Truher [MSFT] <jimtru@microsoft.com>
* address codefactor
* address Ilya's feedback creating a base class for both cmdlets
* remove unused `using`
---------
Co-authored-by: James Truher [MSFT] <jimtru@microsoft.com>
Patrick Meinecke