GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Protect property assignment on non-core objects to NoteProperty members in Constrained Language Mode by jshigetomi · Pull Request #28206 · PowerShell/PowerShell

Conversation

@jshigetomi

@jshigetomi Justin Chung (jshigetomi) commented Oct 14, 2026

Copy link
Copy Markdown
Collaborator

PR Summary

This pull request strengthens property-setting restrictions in Constrained Language mode in PowerShell, ensuring that only NoteProperty instance members can be set on user objects, and that attempts to set other property types (such as ScriptProperty or AliasProperty) are properly blocked and audited. The changes also add targeted tests to verify this behavior.

PR Context

PR Checklist

  • PR has a meaningful title
    • Use the present tense and imperative mood when describing your changes
  • Summarized changes
  • Make sure all .h, .cpp, .cs, .ps1 and .psm1 files have the correct copyright header
  • This PR is ready to merge. If this PR is a work in progress, please open this as a Draft Pull Request and mark it as Ready to Review when it is ready to merge.
  • Breaking changes
    • None
    • OR
    • Experimental feature(s) needed
      • Experimental feature name(s):
  • User-facing changes
    • Not Applicable
    • OR
    • Documentation needed
      • Issue filed:
  • Testing - New and feature
    • N/A or can only be tested interactively
    • OR
    • Make sure you've added a new test if existing tests do not effectively test the code changed

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Patrick Meinecke Justin Chung
Add additional language mode checks to PSSetMemberBinder (#202)
9bd631f
@jshigetomi Justin Chung (jshigetomi) added the CL-General Indicates that a PR should be marked as a general cmdlet change in the Change Log label Oct 14, 2026
@azure-pipelines

azure-pipelines Bot commented Oct 14, 2026

Copy link
Copy Markdown
Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@jshigetomi Justin Chung (jshigetomi) changed the title Add additional language mode checks to PSSetMemberBinder Restrict property assignment on non-core objects to NoteProperty members in Constrained Language Mode Oct 14, 2026
@jshigetomi
Merge branch 'master' into 202
1450411
@jshigetomi
Justin Chung (jshigetomi) marked this pull request as ready for review October 14, 2026 21:43
@jshigetomi
Justin Chung (jshigetomi) requested review from a team, Patrick Meinecke (SeeminglyScience) and Dongbo Wang (daxian-dbw) as code owners October 14, 2026 21:43
Copilot AI balanced review requested due to automatic review settings October 14, 2026 21:43
Copilot started reviewing on behalf of Justin Chung (jshigetomi) October 14, 2026 21:44
View session
Copilot AI reviewed Oct 14, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

Security-boundary changes need human validation of enforcement, cached bindings, and audit behavior, with a regression-coverage gap remaining.

1 open finding
  • Medium severity Add regression test for constrained-language ToString property assignment · New
What changed in this PR

Strengthens Constrained Language property-assignment restrictions for non-core objects.

Changes:

  • Restricts instance-member writes to exact PSNoteProperty members, with audit-mode logging.
  • Removes the non-instance setter exemption for ToString.
  • Adds rejection tests for instance ScriptProperty and AliasProperty assignments.
File Description
test/​powershell/​Modules/​Microsoft.PowerShell.Security/​ConstrainedLanguageRestriction.Tests.ps1 Adds constrained-language assignment tests.
src/​System.Management.Automation/​engine/​runtime/​Binding/​Binders.cs Enforces setter restrictions and audit logging.
src/​System.Management.Automation/​engine/​parser/​Compiler.cs Caches reflection metadata for the new setter helper.

🧠 Review effort: Balanced

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Comment thread src/System.Management.Automation/engine/runtime/Binding/Binders.cs
constrainedTargetType = targetValue.GetType();
}

if (!CoreTypes.Contains(constrainedTargetType))
@jshigetomi Justin Chung (jshigetomi) changed the title Restrict property assignment on non-core objects to NoteProperty members in Constrained Language Mode Protect property assignment on non-core objects to NoteProperty members in Constrained Language Mode Oct 16, 2026
daxian-dbw
Dongbo Wang (daxian-dbw) approved these changes Oct 19, 2026
View reviewed changes
@jshigetomi
Justin Chung (jshigetomi) merged commit b366b2d into master Oct 20, 2026
38 checks passed

Uh oh!

There was an error while loading. Please reload this page.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@daxian-dbw Dongbo Wang (daxian-dbw) daxian-dbw approved these changes
@SeeminglyScience Patrick Meinecke (SeeminglyScience) Awaiting requested review from SeeminglyScience SeeminglyScience is a code owner

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

CL-General Indicates that a PR should be marked as a general cmdlet change in the Change Log

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@jshigetomi @daxian-dbw
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.