Documentation
¶
Overview ¶
Package psdata builds PowerShell scripts in which caller-supplied values are carried as data rather than interpolated into the script as source text.
It lives in its own package, rather than beside either caller, because both pkg/windows (the tool layer) and internal/desktop (the engine) assemble PowerShell and pkg/windows already imports internal/desktop — so a shared helper in either one would be a cycle or a copy. A security primitive that exists twice is one that gets fixed once, so it exists here instead.
The package is deliberately untagged: it is pure string assembly with no Windows dependency, so its injection-safety tests run on any platform.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Builder ¶
type Builder struct {
// contains filtered or unexported fields
}
Builder assembles a PowerShell script in which every caller-supplied value is bound to a variable carrying base64 data.
Quoting is not a viable defence here, which is why this type exists. The PowerShell lexer closes a single-quoted literal on U+2018, U+2019, U+201A and U+201B as well as on U+0027, so an escaper that doubles only the ASCII apostrophe lets a value containing a typographic quote terminate its literal and begin a new statement. -EncodedCommand does not help: the injection is in the script text before it is encoded.
Binding removes the class rather than enumerating it. Base64's alphabet is [A-Za-z0-9+/=], which holds no character the lexer treats as a delimiter, so a bound value cannot be parsed as code however it is spelled — and it never passes through the lexer at all.
The zero value is ready to use.
func (*Builder) Arg ¶
Arg binds v and returns the variable reference to use in the script body.
A variable in argument position is passed as a single value and is not re-tokenized, so a value beginning with "-" is bound as an argument and never read as a parameter name. Call Arg for every caller-supplied value; never concatenate one into the body directly.
Source Files