GeezerVison

PR Summary

This PR includes some changes and cleanups that will reduce the startup time. Each commit is self-contained, and the commit message serves as a summary of the changes in the commit.

• Rename s_wasSystemPolicyDebugPolicy to s_allowDebugOverridePolicy to make it less confusing. Also slightly refactor HelperSecurity.psm1 and ConstrainedLanguageDebugger.Tests.ps1 to remove unneeded code. There is no functional change in this commit.
• Remove the unneeded static property IsInbox, as PowerShell Core won't be shipped in-box with Windows in the foreseeable feature. Even if we do in future, we won't be needing it because Windows PowerShell will probably be gone by that time.
  • This static property was hit at startup time when constructing the value for $env:PSModulePath, and it will in turn cause IsNanoServer and IsIoT to be evaluated, all of which will trigger access to the Registry. By removing IsInbox, that can be all avoided.
• Update 'BindRunspace' to avoid getting all commands and unneeded method calls.
  • BindRunspace retrieves all available commands from the session state, but for the most common scenario of creating/opening a Runspace, the retrieved commands are never get used afterwards. The method is updated to avoid retrieving all commands unless it's necessary.
  • The method is also updated to add check before calling into a ProcessXXX method, so that we can avoid some unneeded method calls.
• Avoid creating a IsSafeValueVisitor every time when IsScriptBlockInFactASafeHashtable runs.
  • The static method IsSafeValueVisitor.IsAstSafe creates an instance of IsSafeValueVisitor every time it runs. Given that IsScriptBlockInFactASafeHashtable gets called relatively frequently in PerformSecurityCheck, this will result in some GC pressure as it will generate transient objects. This is updated to reuse a IsSafeValueVisitor singleton with the default SafeValueContext.
  • The Default and _safeValueContext fields are made readonly, so it cannot be changed by reflection.
  • The _visitCount is changed to uint type, so an attacker cannot change the value of it to a negative number in order to practically increase the max visit count limit.

PR Checklist

• PR has a meaningful title
  • Use the present tense and imperative mood when describing your changes
• Summarized changes
• Change is not breaking
• Make sure all .h, .cpp, .cs, .ps1 and .psm1 files have the correct copyright header
• This PR is ready to merge and is not Work in Progress.
  • If the PR is work in progress, please add the prefix WIP: to the beginning of the title and remove the prefix when the PR is ready.
• User-facing changes
  • Not Applicable
  • OR
  • User-facing Documentation needed
    • Issue filed - Issue link:
• Testing - New and feature
  • Not Applicable or can only be tested interactively
  • OR
  • Make sure you've added a new test if existing tests do not effectively test the code changed
    • Add [feature] if the change is significant or affects feature tests