GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — Protect ForEach() property assignment on non-core types in Constrained Language Mode by jshigetomi · Pull Request #28207 · PowerShell/PowerShell

Conversation

Justin Chung (jshigetomi) commented Oct 14, 2026

Copy link

Copy Markdown

Collaborator

PR Summary

This pull request strengthens the security enforcement for property setting via the ForEach engine intrinsic method in Constrained Language mode and adds corresponding tests to verify the behavior. The main change is to prevent property assignment on non-core types when PowerShell is running in Constrained Language mode, except when the system is only auditing (not enforcing) the policy.

PR Context

PR Checklist

PR has a meaningful title
- Use the present tense and imperative mood when describing your changes
Summarized changes
Make sure all .h, .cpp, .cs, .ps1 and .psm1 files have the correct copyright header
This PR is ready to merge. If this PR is a work in progress, please open this as a Draft Pull Request and mark it as Ready to Review when it is ready to merge.
Breaking changes
- None
- OR
- Experimental feature(s) needed
  - Experimental feature name(s):
User-facing changes
- Not Applicable
- OR
- Documentation needed
  - Issue filed:
Testing - New and feature
- N/A or can only be tested interactively
- OR
- Make sure you've added a new test if existing tests do not effectively test the code changed

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions


          Throw in ForEach method if setting property in CLM (#170)

97a6037

Copilot AI balanced review requested due to automatic review settings

October 14, 2026 18:16

Justin Chung (jshigetomi) requested a review from a team as a code owner

October 14, 2026 18:16

Justin Chung (jshigetomi) added the CL-General Indicates that a PR should be marked as a general cmdlet change in the Change Log label

Oct 14, 2026

azure-pipelines Bot commented Oct 14, 2026

Copy link

Copy Markdown

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Copilot started reviewing on behalf of Justin Chung (jshigetomi)

October 14, 2026 18:17

View session

Copilot AI reviewed

Oct 14, 2026

View reviewed changes

Copilot AI left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

Human security review remains necessary for enforcement and audit behavior, with an unresolved compatibility regression.

1 open finding

Allow instance note properties in Constrained Language mode · New

What changed in this PR

Strengthens Constrained Language enforcement for property assignments through PowerShell’s intrinsic ForEach method.

Changes:

Rejects non-core property assignments while allowing audit-only execution with logging.
Adds tests for rejected non-core setters and permitted core-type setters.

File	Description
test/powershell/Modules/Microsoft.PowerShell.Security/ConstrainedLanguageRestriction.Tests.ps1	Adds property-assignment restriction tests.
src/System.Management.Automation/engine/runtime/Operations/MiscOps.cs	Adds setter enforcement and audit logging.

🧠 Review effort: Balanced

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

src/System.Management.Automation/engine/runtime/Operations/MiscOps.cs

		var property = member as PSPropertyInfo;
		if (languageMode == PSLanguageMode.ConstrainedLanguage
		&& numArgs != 0
		&& !CoreTypes.Contains(basedCurrent.GetType()))

Justin Chung (jshigetomi) changed the title ~~Throw in ForEach method if setting property in CLM~~ Restrict ForEach() property assignment on non-core types in Constrained Language Mode

Oct 14, 2026


          Merge branch 'master' into 170

bb286ed

Justin Chung (jshigetomi) changed the title ~~Restrict ForEach() property assignment on non-core types in Constrained Language Mode~~ Protect ForEach() property assignment on non-core types in Constrained Language Mode

Oct 16, 2026

Aditya Patwardhan (adityapatwardhan) approved these changes

Oct 19, 2026

View reviewed changes

Justin Chung (jshigetomi) merged commit c630a22 into master

Oct 19, 2026

37 checks passed

Uh oh!

There was an error while loading. Please reload this page.

Reviewers

Copilot code review Copilot

Copilot review effort

Applies to this pull request for everyone.Learn more about Copilot code review.

Copilot left review comments

Aditya Patwardhan (adityapatwardhan)

adityapatwardhan approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

CL-General

Indicates that a PR should be marked as a general cmdlet change in the Change Log

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.