PowerShell / PSScriptAnalyzer

Download ScriptAnalyzer from PowerShellGallery
https://www.powershellgallery.com/packages/PSScriptAnalyzer/
MIT License
1.85k stars 373 forks source link

Add AvoidUsingAllowUnencryptedAuthentication #1857

Closed MJVL closed 7 months ago

MJVL commented 1 year ago

PR Summary

This adds a new rule: AvoidUsingAllowUnencryptedAuthentication.

This rule searches for use of the -AllowUnencryptedAuthentication switch. This mainly serves to flag use with Invoke-WebRequest and Invoke-RestMethod, but also works for other cmdlets which may use the same parameter scheme.

This parameter is directly warned against in MSDN as it isn't secure. It is risky and should only be used for compatibility with legacy systems. A Warning here should be sufficient to dissuade against this.

PR Checklist