From 008e2e99fbb309f1c4fd2a0663bf1358cf4e033d Mon Sep 17 00:00:00 2001 From: James Truher Date: Thu, 18 Feb 2021 16:49:36 -0800 Subject: [PATCH 1/5] Change signature validation logic to call first without the file content. Only validate the signature with the content if the first non-content validation fails --- .../security/SecurityManager.cs | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/src/System.Management.Automation/security/SecurityManager.cs b/src/System.Management.Automation/security/SecurityManager.cs index 1b554ad3940..1216f485b82 100644 --- a/src/System.Management.Automation/security/SecurityManager.cs +++ b/src/System.Management.Automation/security/SecurityManager.cs @@ -516,11 +516,24 @@ private static void UntrustPublisher(Signature signature) } } + // Check the signature via the SIP which should never erroneously validate an invalid signature + // or altered script. private static Signature GetSignatureWithEncodingRetry(string path, ExternalScriptInfo script) { + + // Invoke the SIP directly with the most simple method + Signature signature = SignatureHelper.GetSignature(path, null); + if (signature.Status == SignatureStatus.Valid) + { + return signature; + } + + // try harder to validate the signature by being explicit about encoding + // and providing the script contents string verificationContents = System.Text.Encoding.Unicode.GetString(script.OriginalEncoding.GetPreamble()) + script.ScriptContents; - Signature signature = SignatureHelper.GetSignature(path, verificationContents); + signature = SignatureHelper.GetSignature(path, verificationContents); + // A last ditch effort - // If the file was originally ASCII or UTF8, the SIP may have added the Unicode BOM if ((signature.Status != SignatureStatus.Valid) && (script.OriginalEncoding != System.Text.Encoding.Unicode)) { From f9bb569a67372c30bc9669386ce0fa3f7e26919f Mon Sep 17 00:00:00 2001 From: James Truher Date: Thu, 18 Feb 2021 17:51:59 -0800 Subject: [PATCH 2/5] remove extraneous extra line --- src/System.Management.Automation/security/SecurityManager.cs | 1 - 1 file changed, 1 deletion(-) diff --git a/src/System.Management.Automation/security/SecurityManager.cs b/src/System.Management.Automation/security/SecurityManager.cs index 1216f485b82..9d627499b50 100644 --- a/src/System.Management.Automation/security/SecurityManager.cs +++ b/src/System.Management.Automation/security/SecurityManager.cs @@ -520,7 +520,6 @@ private static void UntrustPublisher(Signature signature) // or altered script. private static Signature GetSignatureWithEncodingRetry(string path, ExternalScriptInfo script) { - // Invoke the SIP directly with the most simple method Signature signature = SignatureHelper.GetSignature(path, null); if (signature.Status == SignatureStatus.Valid) From c43b472bb717855c0e7c24be8051553f9f6ffc6a Mon Sep 17 00:00:00 2001 From: Travis Plunk Date: Fri, 19 Feb 2021 12:02:52 -0800 Subject: [PATCH 3/5] Update src/System.Management.Automation/security/SecurityManager.cs Co-authored-by: Ilya --- src/System.Management.Automation/security/SecurityManager.cs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/System.Management.Automation/security/SecurityManager.cs b/src/System.Management.Automation/security/SecurityManager.cs index 9d627499b50..01e024862fd 100644 --- a/src/System.Management.Automation/security/SecurityManager.cs +++ b/src/System.Management.Automation/security/SecurityManager.cs @@ -521,7 +521,7 @@ private static void UntrustPublisher(Signature signature) private static Signature GetSignatureWithEncodingRetry(string path, ExternalScriptInfo script) { // Invoke the SIP directly with the most simple method - Signature signature = SignatureHelper.GetSignature(path, null); + Signature signature = SignatureHelper.GetSignature(path, fileContent: null); if (signature.Status == SignatureStatus.Valid) { return signature; From 72e4cd1e94de2fe3b1c6fec729af498ad6e7f790 Mon Sep 17 00:00:00 2001 From: James Truher Date: Fri, 19 Feb 2021 13:38:11 -0800 Subject: [PATCH 4/5] use system.text namespace --- .../security/SecurityManager.cs | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/System.Management.Automation/security/SecurityManager.cs b/src/System.Management.Automation/security/SecurityManager.cs index 01e024862fd..3686efc0744 100644 --- a/src/System.Management.Automation/security/SecurityManager.cs +++ b/src/System.Management.Automation/security/SecurityManager.cs @@ -11,6 +11,7 @@ using System.Management.Automation.Security; using System.Security; using System.Security.Cryptography.X509Certificates; +using System.Text; using Dbg = System.Management.Automation; @@ -529,14 +530,14 @@ private static Signature GetSignatureWithEncodingRetry(string path, ExternalScri // try harder to validate the signature by being explicit about encoding // and providing the script contents - string verificationContents = System.Text.Encoding.Unicode.GetString(script.OriginalEncoding.GetPreamble()) + script.ScriptContents; + string verificationContents = Encoding.Unicode.GetString(script.OriginalEncoding.GetPreamble()) + script.ScriptContents; signature = SignatureHelper.GetSignature(path, verificationContents); // A last ditch effort - // If the file was originally ASCII or UTF8, the SIP may have added the Unicode BOM - if ((signature.Status != SignatureStatus.Valid) && (script.OriginalEncoding != System.Text.Encoding.Unicode)) + if ((signature.Status != SignatureStatus.Valid) && (script.OriginalEncoding != Encoding.Unicode)) { - verificationContents = System.Text.Encoding.Unicode.GetString(System.Text.Encoding.Unicode.GetPreamble()) + script.ScriptContents; + verificationContents = Encoding.Unicode.GetString(Encoding.Unicode.GetPreamble()) + script.ScriptContents; Signature fallbackSignature = SignatureHelper.GetSignature(path, verificationContents); if (fallbackSignature.Status == SignatureStatus.Valid) From 113064a4fab42f915c459879cc6044bf21a8a27f Mon Sep 17 00:00:00 2001 From: "James Truher [MSFT]" Date: Mon, 22 Feb 2021 10:01:17 -0800 Subject: [PATCH 5/5] Update src/System.Management.Automation/security/SecurityManager.cs Co-authored-by: Robert Holt --- src/System.Management.Automation/security/SecurityManager.cs | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/System.Management.Automation/security/SecurityManager.cs b/src/System.Management.Automation/security/SecurityManager.cs index 3686efc0744..be0c8d83b24 100644 --- a/src/System.Management.Automation/security/SecurityManager.cs +++ b/src/System.Management.Automation/security/SecurityManager.cs @@ -535,7 +535,8 @@ private static Signature GetSignatureWithEncodingRetry(string path, ExternalScri // A last ditch effort - // If the file was originally ASCII or UTF8, the SIP may have added the Unicode BOM - if ((signature.Status != SignatureStatus.Valid) && (script.OriginalEncoding != Encoding.Unicode)) + if (signature.Status != SignatureStatus.Valid + && script.OriginalEncoding != Encoding.Unicode) { verificationContents = Encoding.Unicode.GetString(Encoding.Unicode.GetPreamble()) + script.ScriptContents; Signature fallbackSignature = SignatureHelper.GetSignature(path, verificationContents);