Patrick Meinecke
2207e9e3e7
<!-- Anything that looks like this is a comment and can't be seen after the Pull Request is created. --> ### PR Summary Add the xsd validation back for CIM cmdlets for PowerShell v7. 1. Instead of baking the huge `.xsd` file in a `.resx` resource file (which is what PS 5.1 does and depends on `System.Windows.Forms`), it's better to directly embed the `.xsd` file in the assembly as resource. 2. Refactored the static constructor of `ScriptWriter` to enable `DtdProcessing.Parse` for PowerShell 7. ---- #### AI description (iteration 1) #### PR Classification Security fix to restore XSD validation for CIM cmdletization and prevent XML injection attacks. #### PR Summary This PR re-enables XSD schema validation for CIM cmdlets that was previously disabled in .NET Core, addressing a security vulnerability where malicious XML could be injected through cmdletization files. The fix embeds the XSD schema as a manifest resource and restores validation logic. - `ScriptWriter.cs`: Removed conditional compilation directives, restored XSD validation for all platforms, and refactored XML reader settings initialization to load schema from embedded resource - `System.Management.Automation.csproj`: Added `cmdlets-over-objects.xsd` as an embedded resource to enable schema validation - `Cdxml.Tests.ps1` and `invalid_verb.cdxml`: Added security test case to verify that XML injection attempts in the 'Verb' attribute are blocked by validation - `CmdletizationResources.resx`: Removed unused assembly reference <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
Pester Testing Test Guide
Also see the Writing Pester Tests document.
Running Pester Tests
Go to the top level of the PowerShell repository and run: Start-PSPester
inside a self-hosted copy of PowerShell.
You can use Start-PSPester -Tests SomeTestSuite* to limit the tests run.
Testing new powershell processes
Any launch of a new powershell process must include -noprofile so that
modified user and system profiles do not causes tests to fail. You also must
take care to call the development copy of PowerShell, which is not the first
one on the path.
Example:
$powershell = Join-Path -Path $PsHome -ChildPath "pwsh"
& $powershell -noprofile -command "ExampleCommand" | Should Be "ExampleOutput"
Portability
Some tests simply must be tied to certain platforms. Use Pester's
-Skip directive on an It statement to do this. For instance to run
the test only on Windows:
It "Should do something on Windows" -Skip:($IsLinux -Or $IsMacOS) { ... }
Or only on Linux and OS X:
It "Should do something on Linux" -Skip:$IsWindows { ... }
Pending
When writing a test that should pass, but does not, please do not skip or delete
the test, but use It "Should Pass" -Pending to mark the test as pending, and
file an issue on GitHub.