Skip to content

Whitelisted scripts with cmdletbinding cannot be executed by pwsh -File <Path> when applocker is enabled #20508

Description

@MartinGC94

Prerequisites

Steps to reproduce

Step 1: Create a script with the cmdletbinding attribute and a type that hasn't been whitelisted in constrained language mode. Demo script:

[cmdletbinding()]
param()
$null = [System.Collections.Generic.List[string]]::new()
pause

Step 2: Enable applocker with the default rules for scripts and add a whitelist rule for the test script.
Step 3: Try to launch a new instance of pwsh where the File parameter points to the test script, for example: Start-Process -FilePath pwsh.exe -ArgumentList ("-ExecutionPolicy", "Bypass", "-File", "C:\Test\TestScript.ps1") -RedirectStandardOutput $Home\Desktop\Error.txt (Redirected output to make it easier to see the error message).

The error message will say:
�[31;1mTestScript.ps1: �[31;1mCannot dot-source this command because it was defined in a different language mode. To invoke this command without importing its contents, omit the '.' operator.�[0m

Step 4: Edit the script to remove the cmdletbinding attribute and try to run it again. This time it will succeed.

A simple workaround is to replace the -File parameter with -Command and run the script with & like this: Start-Process -FilePath pwsh.exe -ArgumentList ("-ExecutionPolicy", "Bypass", "-Command", "& C:\Test\TestScript.ps1").
I would imagine the fix for this is to just not dot-source the scripts specified by the -File parameter unless NoExit has also been specified (there's no point in dot-sourcing if the process stops after script execution anyway).
If that's considered too big of a breaking change then a new parameter could be added to allow users to explicitly tell PS to not dot-source the script.
For what it's worth, Windows PowerShell suffers from the same issue.

Expected behavior

N/A

Actual behavior

N/A

Error details

No response

Environment data

Name                           Value
----                           -----
PSVersion                      7.4.0-preview.6
PSEdition                      Core
GitCommitId                    7.4.0-preview.6
OS                             Microsoft Windows 10.0.22621
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

Visuals

No response

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions