mirror of
https://github.com/aphrody-labs/PowerShell.git
synced 2026-10-15 06:09:09 +00:00
Patrick Meinecke
4b0b4c5a8e
<!-- Anything that looks like this is a comment and can't be seen after the Pull Request is created. --> ### PR Summary Add the xsd validation back for CIM cmdlets for PowerShell v7. 1. Instead of baking the huge `.xsd` file in a `.resx` resource file (which is what PS 5.1 does and depends on `System.Windows.Forms`), it's better to directly embed the `.xsd` file in the assembly as resource. 2. Refactored the static constructor of `ScriptWriter` to enable `DtdProcessing.Parse` for PowerShell 7. ---- #### AI description (iteration 1) #### PR Classification Security fix to re-enable XSD validation for CIM cmdlets to prevent injection attacks. #### PR Summary This PR restores XSD schema validation for CIM cmdletization that was previously disabled in .NET Core, addressing a security vulnerability where malicious XML could inject code through invalid verb names in CDXML files. - `ScriptWriter.cs`: Removed conditional compilation directives, re-enabled XSD validation for all platforms, and refactored XML reader settings initialization to load the schema from embedded resources - `System.Management.Automation.csproj`: Added `cmdlets-over-objects.xsd` as an embedded resource to make the XSD schema available at runtime - `Cdxml.Tests.ps1` and `invalid_verb.cdxml`: Added test case to verify that CDXML files with malicious code injection in the Verb attribute are properly rejected during import <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->