Skip to content

Add Optional PSUseConstrainedLanguageMode rule #2165

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
joshcorr wants to merge 20 commits into
base: main
Choose a base branch
from
+2,398 −0
Open

Add Optional PSUseConstrainedLanguageMode rule #2165

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
20 commits
Select commit Hold shift + click to select a range
67e239a
Add UseConstrainedLanguageMode rule and tests
joshcorr Mar 7, 2026
e616116
Enhance CLM rule: restrict types, COM objects, add tests
joshcorr Mar 8, 2026
790fe8c
Enhance detection of disallowed types in CLM rule
joshcorr Mar 8, 2026
b4b566c
Detect and flag class definitions in Constrained Language
joshcorr Mar 15, 2026
f8ab608
Enhance CLM rule to check module manifests for wildcards/.ps1
joshcorr Mar 15, 2026
1be14c8
Differentiate CLM checks for signed vs unsigned scripts
joshcorr Mar 15, 2026
a23e14f
Improve dot-sourcing detection and expand CLM rule tests
joshcorr Mar 15, 2026
1abc86a
Add IgnoreSignatures option to CLM rule and improve type checks
joshcorr Mar 16, 2026
3526267
Add documentation for PSUseConstrainedLanguageMode rule
joshcorr Mar 17, 2026
d87628d
Increase severity of UseConstrainedLanguageMode to Warning for option…
joshcorr Mar 17, 2026
69b200f
Update test to expect 'Warning' severity instead of 'Info'
joshcorr Mar 17, 2026
17f1a24
Making copilot suggested edits
joshcorr Mar 17, 2026
a4a4a93
Detect and flag [PSCustomObject]@{} in CLM scripts
joshcorr Mar 17, 2026
5336b8f
Add UseConstrainedLanguageMode rule to README.md
joshcorr Mar 18, 2026
aedace7
Merge branch 'main' into addCLMRules
joshcorr Mar 18, 2026
cba70f3
Update CLM rule: tighten types, docs, and add error string
joshcorr Mar 19, 2026
02598ac
Add platform checks to CLM tests for cross-platform support
joshcorr Mar 20, 2026
9c91f63
Merge branch 'main' into addCLMRules
joshcorr Mar 20, 2026
650d050
Add missing end tag after merge conflict from main
joshcorr Mar 20, 2026
3d3afc8
Add CLM rule ScriptsToProcess; Fix wildcard and dotsource bug
joshcorr Mar 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
54 changes: 54 additions & 0 deletions Rules/Strings.resx
View file
Open in desktop
Copy link
Collaborator

@bergmeister bergmeister Mar 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can you please tidy away the whitespace diff please? might be easiest to just copy paste the first 58 lines from main over this

Copy link
Author

@joshcorr joshcorr Mar 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in the latest commit.

Original file line number Diff line number Diff line change
Expand Up @@ -1263,6 +1263,60 @@
<data name="AvoidReservedWordsAsFunctionNamesError" xml:space="preserve">
<value>The reserved word '{0}' was used as a function name. This should be avoided.</value>
</data>
<data name="UseConstrainedLanguageModeName" xml:space="preserve">
<value>UseConstrainedLanguageMode</value>
</data>
<data name="UseConstrainedLanguageModeCommonName" xml:space="preserve">
<value>Consider Constrained Language Mode Restrictions</value>
</data>
<data name="UseConstrainedLanguageModeDescription" xml:space="preserve">
<value>Identifies script patterns that are restricted in Constrained Language Mode. Constrained Language Mode limits the types, cmdlets, and .NET methods that can be used to help secure PowerShell in environments requiring additional restrictions.</value>
</data>
<data name="UseConstrainedLanguageModeAddTypeError" xml:space="preserve">
<value>Add-Type is not permitted in Constrained Language Mode. Consider alternative approaches if this script will run in a restricted environment.</value>
</data>
<data name="UseConstrainedLanguageModeComObjectError" xml:space="preserve">
<value>New-Object with the COM object '{0}' is not permitted in Constrained Language Mode. Consider alternative approaches if this script will run in a restricted environment.</value>
</data>
<data name="UseConstrainedLanguageModeXamlError" xml:space="preserve">
<value>XAML usage is not permitted in Constrained Language Mode. Consider alternative approaches if this script will run in a restricted environment.</value>
</data>
<data name="UseConstrainedLanguageModeDotSourceError" xml:space="preserve">
<value>Dot-sourcing may be restricted in Constrained Language Mode depending on the source location. Ensure scripts are from trusted locations if running in a restricted environment.</value>
</data>
<data name="UseConstrainedLanguageModeInvokeExpressionError" xml:space="preserve">
<value>Invoke-Expression is restricted in Constrained Language Mode. Consider alternative approaches if this script will run in a restricted environment.</value>
</data>
<data name="UseConstrainedLanguageModeNewObjectError" xml:space="preserve">
<value>New-Object with type '{0}' is not permitted in Constrained Language Mode. Consider using an allowed type.</value>
</data>
<data name="UseConstrainedLanguageModeConstrainedTypeError" xml:space="preserve">
<value>Type constraint [{0}] is not permitted in Constrained Language Mode. Consider using an allowed type.</value>
</data>
<data name="UseConstrainedLanguageModeTypeExpressionError" xml:space="preserve">
<value>Type expression [{0}] is not permitted in Constrained Language Mode. Consider using an allowed type.</value>
</data>
<data name="UseConstrainedLanguageModeConvertExpressionError" xml:space="preserve">
<value>Type cast [{0}] is not permitted in Constrained Language Mode. Consider using an allowed type.</value>
</data>
<data name="UseConstrainedLanguageModeMemberAccessError" xml:space="preserve">
<value>Member '{1}' accessed on type [{0}] which is not permitted in Constrained Language Mode. Consider using an allowed type.</value>
</data>
<data name="UseConstrainedLanguageModeClassError" xml:space="preserve">
<value>PowerShell class '{0}' is not permitted in Constrained Language Mode. Consider using alternative approaches such as hashtables or PSCustomObject.</value>
</data>
<data name="UseConstrainedLanguageModeWildcardExportError" xml:space="preserve">
<value>Module manifest field '{0}' uses wildcard ('*') which is not recommended for Constrained Language Mode. Explicitly list exported items instead.</value>
</data>
<data name="UseConstrainedLanguageModeScriptModuleError" xml:space="preserve">
<value>Module manifest field '{0}' contains script file '{1}' (.ps1). Use a module file (.psm1) or a binary module (.dll) instead for Constrained Language Mode compatibility.</value>
</data>
<data name="UseConstrainedLanguageModeScriptsToProcessError" xml:space="preserve">
<value>Module manifest field 'ScriptsToProcess' contains script file '{0}' (.ps1). Scripts in ScriptsToProcess run in the caller's session state and are restricted in Constrained Language Mode. Consider moving this logic to module initialization code</value>
</data>
<data name="UseConstrainedLanguageModePSCustomObjectError" xml:space="preserve">
<value>[PSCustomObject]@{{}} syntax is not permitted in Constrained Language Mode. Use New-Object PSObject -Property @{{}} or plain hashtables instead.</value>
</data>
<data name="UseSingleValueFromPipelineParameterCommonName" xml:space="preserve">
<value>Use a single ValueFromPipeline parameter per parameter set</value>
</data>
Expand Down
Loading