cisagov / LME

Logging Made Easy (LME) is a no-cost and open logging and protective monitoring solution serving all organizations.
https://www.cisa.gov/resources-tools/services/logging-made-easy
Other
763 stars 59 forks source link

[BUG] Address the use of Invoke-Expression #327

Open mitchelbaker-cisa opened 3 weeks ago

mitchelbaker-cisa commented 3 weeks ago

BEFORE CREATING THE ISSUE, CHECK THE FOLLOWING GUIDES:

Describe the bug

The Invoke-Expression cmdlet should only be used as a last resort since it has implications such as code injection. In most scenarios, safer and more robust alternatives are available.

SetupTestbed.ps1 and install_lme.ps1 are the two files which should be updated.

Additional info: https://learn.microsoft.com/en-us/powershell/scripting/learn/deep-dives/avoid-using-invoke-expression?view=powershell-7.4 https://learn.microsoft.com/en-us/powershell/utility-modules/psscriptanalyzer/rules/avoidusinginvokeexpression?view=ps-modules

Expected behavior

Same behavior is expected, solution is to simply invoke the command directly.