Block getting help from network locations in restricted remoting session #20593

TravisEz13 · 2023-10-27T18:23:55Z

PR Summary

Block getting help from network locations in restricted remoting session (JEA, exchange remoting, and similar custom remoting sessions)

PR Context

This was already released in the servicing releases.

This is mitigated if the restricted proxy is used for get-help or if the file system provider is hidden for the session, but not all customers implemented this way.

We have already documented that you should have these other protections in place to protect these scenarios:
https://learn.microsoft.com/en-us/powershell/scripting/dev-cross-plat/security/securing-restricted-sessions?view=powershell-7.3

Defense in depth security fix

Conflicts:

src/System.Management.Automation/engine/Utils.cs
test/tools/Modules/HelpersCommon/HelpersCommon.psd1
test/tools/Modules/HelpersCommon/HelpersCommon.psm1

PR Checklist

…ions Cherry picked from !27698 # Conflicts: # src/System.Management.Automation/engine/Utils.cs # test/tools/Modules/HelpersCommon/HelpersCommon.psd1 # test/tools/Modules/HelpersCommon/HelpersCommon.psm1

pull-request-quantifier-deprecated · 2023-10-27T18:24:35Z

This PR has 123 quantified lines of changes. In general, a change size of upto 200 lines is ideal for the best PR experience!

Quantification details

Label      : Medium
Size       : +110 -13
Percentile : 44.6%

Total files changed: 9

Change summary by file extension:
.cs : +15 -13
.resx : +3 -0
.ps1 : +30 -0
.psd1 : +1 -0
.psm1 : +61 -0

Change counts above are quantified counts, based on the PullRequestQuantifier customizations.

Why proper sizing of changes matters

Optimal pull request sizes drive a better predictable PR flow as they strike a
balance between between PR complexity and PR review overhead. PRs within the
optimal size (typical small, or medium sized PRs) mean:

Fast and predictable releases to production:
- Optimal size changes are more likely to be reviewed faster with fewer
  iterations.
- Similarity in low PR complexity drives similar review times.
Review quality is likely higher as complexity is lower:
- Bugs are more likely to be detected.
- Code inconsistencies are more likely to be detected.
Knowledge sharing is improved within the participants:
- Small portions can be assimilated better.
Better engineering practices are exercised:
- Solving big problems by dividing them in well contained, smaller problems.
- Exercising separation of concerns within the code changes.

What can I do to optimize my changes

Use the PullRequestQuantifier to quantify your PR accurately
- Create a context profile for your repo using the context generator
- Exclude files that are not necessary to be reviewed or do not increase the review complexity. Example: Autogenerated code, docs, project IDE setting files, binaries, etc. Check out the Excluded section from your prquantifier.yaml context profile.
- Understand your typical change complexity, drive towards the desired complexity by adjusting the label mapping in your prquantifier.yaml context profile.
- Only use the labels that matter to you, see context specification to customize your prquantifier.yaml context profile.
Change your engineering behaviors
- For PRs that fall outside of the desired spectrum, review the details and check if:
  - Your PR could be split in smaller, self-contained PRs instead
  - Your PR only solves one particular issue. (For example, don't refactor and code new features in the same PR).

How to interpret the change counts in git diff output

One line was added: +1 -0
One line was deleted: +0 -1
One line was modified: +1 -1 (git diff doesn't know about modified, it will
interpret that line like one addition plus one deletion)
Change percentiles: Change characteristics (addition, deletion, modification)
of this PR in relation to all other PRs within the repository.

Was this comment helpful? 👍 :ok_hand: :thumbsdown: (Email)
Customize PullRequestQuantifier for this repository.

TravisEz13 · 2023-10-31T18:18:26Z

src/System.Management.Automation/engine/Utils.cs

@@ -1256,7 +1256,8 @@ internal static bool PathIsDevicePath(string path)
 #if UNIX
            return false;
 #else
-            return path.StartsWith(@"\\.\") || path.StartsWith(@"\\?\");
+            // device paths can be network paths, we would need windows to parse it.


This had a merge conflict, I could not find a good reason why.

TravisEz13 · 2023-10-31T18:18:57Z

test/tools/Modules/HelpersCommon/HelpersCommon.psd1

@@ -48,6 +48,7 @@ FunctionsToExport = @(
        'Test-PSDefaultParameterValue'
        'Push-DefaultParameterValueStack'
        'Pop-DefaultParameterValueStack'
+        'Get-HelpNetworkTestCases'


This had a merge conflict because this branch has new changes.

TravisEz13 · 2023-10-31T18:19:06Z

test/tools/Modules/HelpersCommon/HelpersCommon.psm1

@@ -533,3 +533,87 @@ function Pop-DefaultParameterValueStack {
 		return $false
 	}
 }
+


This had a merge conflict because this branch has new changes.

…ions (#20593)

…ions (#20593) (#20615)

…ions (PowerShell#20593)

…owCommand Fixes issue introduced in PowerShell#20593

Block getting help from network locations in restricted remoting sess…

06d75ac

…ions Cherry picked from !27698 # Conflicts: # src/System.Management.Automation/engine/Utils.cs # test/tools/Modules/HelpersCommon/HelpersCommon.psd1 # test/tools/Modules/HelpersCommon/HelpersCommon.psm1

TravisEz13 added MustHave 7.4-Blocking BackPort-7.4.x-Consider labels Oct 27, 2023

TravisEz13 requested review from daxian-dbw, adityapatwardhan and anmenaga as code owners October 27, 2023 18:23

pull-request-quantifier-deprecated bot added the Medium label Oct 27, 2023

TravisEz13 commented Oct 31, 2023

View reviewed changes

adityapatwardhan approved these changes Oct 31, 2023

View reviewed changes

adityapatwardhan merged commit 687383b into PowerShell:master Oct 31, 2023

adityapatwardhan pushed a commit that referenced this pull request Oct 31, 2023

Block getting help from network locations in restricted remoting sess…

3d6e32e

…ions (#20593)

adityapatwardhan mentioned this pull request Oct 31, 2023

[release/v7.4.0] Block getting help from network locations in restricted remoting session #20615

Merged

adityapatwardhan added BackPort-7.4.x-Approved and removed BackPort-7.4.x-Consider labels Oct 31, 2023

adityapatwardhan added a commit that referenced this pull request Nov 1, 2023

Block getting help from network locations in restricted remoting sess…

d1fc83f

…ions (#20593) (#20615)

adityapatwardhan added CL-General Indicates that a PR should be marked as a general cmdlet change in the Change Log BackPort-7.4.x-Done and removed BackPort-7.4.x-Approved labels Nov 1, 2023

jborean93 mentioned this pull request Jul 9, 2024

Invoke-Command $using improvements #24025

Open

21 tasks

chrisdent-de pushed a commit to chrisdent-de/PowerShell that referenced this pull request Sep 12, 2024

Block getting help from network locations in restricted remoting sess…

e8a4429

…ions (PowerShell#20593)

jshigetomi mentioned this pull request Jan 21, 2025

Fix backport issues with release pipeline #24835

Merged

21 tasks

daxian-dbw mentioned this pull request May 13, 2025

Show-Command crashes when clicking "Show Details" on a command #25556

Open

5 tasks

TravisEz13 added a commit to TravisEz13/PowerShell that referenced this pull request May 13, 2025

Add GetImportModuleCommand method and session restriction check in Sh…

8b92cb5

…owCommand Fixes issue introduced in PowerShell#20593

TravisEz13 mentioned this pull request May 13, 2025

Add GetImportModuleCommand method and session restriction check in ShowCommand #25557

Draft

12 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Block getting help from network locations in restricted remoting session #20593

Block getting help from network locations in restricted remoting session #20593

TravisEz13 commented Oct 27, 2023 •

edited

Loading

pull-request-quantifier-deprecated bot commented Oct 27, 2023

What can I do to optimize my changes

How to interpret the change counts in git diff output

TravisEz13 Oct 31, 2023

TravisEz13 Oct 31, 2023

TravisEz13 Oct 31, 2023

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Block getting help from network locations in restricted remoting session #20593

Block getting help from network locations in restricted remoting session #20593

Conversation

TravisEz13 commented Oct 27, 2023 • edited Loading

PR Summary

PR Context

PR Checklist

pull-request-quantifier-deprecated bot commented Oct 27, 2023

What can I do to optimize my changes

How to interpret the change counts in git diff output

TravisEz13 Oct 31, 2023

Choose a reason for hiding this comment

TravisEz13 Oct 31, 2023

Choose a reason for hiding this comment

TravisEz13 Oct 31, 2023

Choose a reason for hiding this comment

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

TravisEz13 commented Oct 27, 2023 •

edited

Loading