Add new AvoidSecretDisclosure rule#2183
Conversation
There was a problem hiding this comment.
Pull request overview
Adds a new built-in PSScriptAnalyzer rule (PSAvoidSecretDisclosure) to flag common patterns that convert secrets (e.g., SecureString) into plaintext, with accompanying tests, localized strings, and documentation.
Changes:
- Introduces
AvoidSecretDisclosurerule implementation to detectConvertFrom-SecureString -AsPlainText,SecureStringTo*calls, and.Passwordmember access. - Adds Pester tests covering violations, compliant examples, and suppression scenarios.
- Updates rule documentation and the rules index, and adds localized strings for name/common name/description/error.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| Tests/Rules/AvoidSecretDisclosure.tests.ps1 | Adds Pester coverage for the new rule (violations/compliance/suppression). |
| Rules/Strings.resx | Adds localized strings for the new rule’s name/common name/description/message. |
| Rules/AvoidSecretDisclosure.cs | Implements the new analyzer rule logic and diagnostic creation. |
| docs/Rules/README.md | Registers the rule in the published rules list/table. |
| docs/Rules/AvoidSecretDisclosure.md | Adds the rule’s public documentation page and examples. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
sdwheeler
left a comment
There was a problem hiding this comment.
Added suggestions for style and one question about the parameter.
| Disclosing a secret might result in security vulnerabilities such as memory trails or logging trails that could | ||
| be exploited by attackers. This rule identifies instances where a secret is being converted to plain text, | ||
| which can lead to unintended exposure of sensitive information. |
There was a problem hiding this comment.
Wrap lines at 100 characters
| Disclosing a secret might result in security vulnerabilities such as memory trails or logging trails that could | |
| be exploited by attackers. This rule identifies instances where a secret is being converted to plain text, | |
| which can lead to unintended exposure of sensitive information. | |
| Disclosing a secret might result in security vulnerabilities such as memory trails or logging trails | |
| that could be exploited by attackers. This rule identifies instances where a secret is being | |
| converted to plain text, which can lead to unintended exposure of sensitive information. |
| > [!IMPORTANT] | ||
| > | ||
| > The general approach of dealing with credentials is to avoid them and instead rely on other means | ||
| > to authenticate, such as certificates or Windows authentication. |
There was a problem hiding this comment.
No blank line after the header of the alert block.
| > [!IMPORTANT] | |
| > | |
| > The general approach of dealing with credentials is to avoid them and instead rely on other means | |
| > to authenticate, such as certificates or Windows authentication. | |
| > [!IMPORTANT] | |
| > The general approach of dealing with credentials is to avoid them and instead rely on other means | |
| > to authenticate, such as certificates or Windows authentication. |
| In general, avoid any code pattern that involves converting secrets to plaintext or accessing plaintext secrets. | ||
|
|
||
| * For `ConvertFrom-SecureString -AsPlainText`: Use `-Credential` parameter instead | ||
| * For `SecureStringTo*` methods: Avoid converting to plaintext | ||
| * For `Password` properties: Use secure credential objects directly or the SecureString equivalent | ||
| `SecurePassword` instead of accessing plaintext passwords. |
There was a problem hiding this comment.
Wrap at 100. Unordered list items start with dash not asterisk.
| In general, avoid any code pattern that involves converting secrets to plaintext or accessing plaintext secrets. | |
| * For `ConvertFrom-SecureString -AsPlainText`: Use `-Credential` parameter instead | |
| * For `SecureStringTo*` methods: Avoid converting to plaintext | |
| * For `Password` properties: Use secure credential objects directly or the SecureString equivalent | |
| `SecurePassword` instead of accessing plaintext passwords. | |
| In general, avoid any code pattern that involves converting secrets to plaintext or accessing | |
| plaintext secrets. | |
| - For `ConvertFrom-SecureString -AsPlainText`: Use `-Credential` parameter instead | |
| - For `SecureStringTo*` methods: Avoid converting to plaintext | |
| - For `Password` properties: Use secure credential objects directly or the SecureString equivalent | |
| `SecurePassword` instead of accessing plaintext passwords. |
| > [!NOTE] | ||
| > | ||
| > For custom properties named "Password", it is recommended to rename them to something that does not imply they | ||
| > contain secrets, or to ensure that they do not actually contain secrets. If renaming is not possible, consider | ||
| > suppressing the warning for those specific cases. |
There was a problem hiding this comment.
| > [!NOTE] | |
| > | |
| > For custom properties named "Password", it is recommended to rename them to something that does not imply they | |
| > contain secrets, or to ensure that they do not actually contain secrets. If renaming is not possible, consider | |
| > suppressing the warning for those specific cases. | |
| > [!NOTE] | |
| > For custom properties named "Password", it is recommended to rename them to something that does | |
| > not imply they contain secrets, or to ensure that they do not actually contain secrets. If | |
| > renaming is not possible, consider suppressing the warning for those specific cases. |
| ## Configuration | ||
|
|
||
| ### Parameters | ||
|
|
||
| * `Enable` - Enables or disables the rule. Default value is `True`. |
There was a problem hiding this comment.
Remove leading space and fix list item.
| ## Configuration | |
| ### Parameters | |
| * `Enable` - Enables or disables the rule. Default value is `True`. | |
| ## Configuration | |
| ### Parameters | |
| - `Enable` - Enables or disables the rule. Default value is `$true`. |
Also, where do you set this parameter? Show the syntax of the setting.
PR Summary
Rule request: #1997
Description
Disclosing a secret might result in security vulnerabilities such as memory trails or logging trails that could
be exploited by attackers. This rule identifies instances where a secret is being converted to plain text,
which can lead to unintended exposure of sensitive information.
Important
The general approach of dealing with credentials is to avoid them and instead rely on other means
to authenticate, such as certificates or Windows authentication.
How to Fix
In general, avoid any code pattern that involves converting secrets to plaintext or accessing plaintext secrets.
ConvertFrom-SecureString -AsPlainText: Use-Credentialparameter insteadSecureStringTo*methods: Avoid converting to plaintextPasswordproperties: Use secure credential objects directly or the SecureString equivalentSecurePasswordinstead of accessing plaintext passwords.Note
For custom properties named "Password", it is recommended to rename them to something that does not imply they
contain secrets, or to ensure that they do not actually contain secrets. If renaming is not possible, consider
suppressing the warning for those specific cases.
PR Checklist
.cs,.ps1and.psm1files have the correct copyright headerWIP:to the beginning of the title and remove the prefix when the PR is ready.