mirror of
https://github.com/aphrody-labs/PowerShell.git
synced 2026-10-15 14:20:03 +00:00
Patrick Meinecke
2207e9e3e7
<!-- Anything that looks like this is a comment and can't be seen after the Pull Request is created. --> ### PR Summary Add the xsd validation back for CIM cmdlets for PowerShell v7. 1. Instead of baking the huge `.xsd` file in a `.resx` resource file (which is what PS 5.1 does and depends on `System.Windows.Forms`), it's better to directly embed the `.xsd` file in the assembly as resource. 2. Refactored the static constructor of `ScriptWriter` to enable `DtdProcessing.Parse` for PowerShell 7. ---- #### AI description (iteration 1) #### PR Classification Security fix to restore XSD validation for CIM cmdletization and prevent XML injection attacks. #### PR Summary This PR re-enables XSD schema validation for CIM cmdlets that was previously disabled in .NET Core, addressing a security vulnerability where malicious XML could be injected through cmdletization files. The fix embeds the XSD schema as a manifest resource and restores validation logic. - `ScriptWriter.cs`: Removed conditional compilation directives, restored XSD validation for all platforms, and refactored XML reader settings initialization to load schema from embedded resource - `System.Management.Automation.csproj`: Added `cmdlets-over-objects.xsd` as an embedded resource to enable schema validation - `Cdxml.Tests.ps1` and `invalid_verb.cdxml`: Added security test case to verify that XML injection attempts in the 'Verb' attribute are blocked by validation - `CmdletizationResources.resx`: Removed unused assembly reference <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->