create-1es-hosted-pool.ps1: Avoid ConvertTo-SecureString#4535
Merged
StephanTLavavej merged 1 commit intomicrosoft:mainfrom Mar 29, 2024
Merged
Conversation
zacklj89
approved these changes
Mar 28, 2024
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This mirrors MSVC-PR-539935, which @joemmett will be merging into MSVC
main.New codebase scanning tools are hissing at how
create-1es-hosted-pool.ps1builds up a plaintext password before converting it into aSecureStringwithConvertTo-SecureString.Jonathan's fix is to start with a
SecureStringand build it up character-by-character. Of course, this still leaves each character in normal memory for a fraction of a nanosecond, but that's unavoidable. This avoids mentioningConvertTo-SecureString, thereby making the tools happy. Later in this script, we redact the generated password from appearing in any console output (my innovation back in #1577), and we discard it entirely after creating the pool, so we're touching it as little as possible.I verified that the updated function works in PowerShell 7.4.1, but I haven't done a full test drive of the updated script.
$AdminPW:STL/azure-devops/create-1es-hosted-pool.ps1
Line 236 in fbdcee4
@joemmett's MSVC-PR is high priority so I want to merge this as-is, then I'll figure out how to fix the script during April Patch Tuesday.