| FazBrowse GitHub Viewer | Trending | | Home |
| Tools: [Download Repo ZIP] [Original HTTPS Page] |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -1404,47 +1404,16 @@ internal static string RedactIfPowerShellCode(string input) | |||
| 1404 | 1404 | return input; | |
| 1405 | 1405 | } | |
| 1406 | 1406 | ||
| 1407 | - bool startsWithDangerousToken = | ||
| 1407 | + bool startsWithOrContainsDangerousToken = | ||
| 1408 | 1408 | input.StartsWith('$') || | |
| 1409 | 1409 | input.StartsWith("@{") || | |
| 1410 | 1410 | input.StartsWith('(') || | |
| 1411 | 1411 | input.StartsWith('"') || | |
| 1412 | - input.StartsWith("'") || | ||
| 1413 | 1412 | input.StartsWith('@') || | |
| 1414 | - input.StartsWith('\''); | ||
| 1413 | + input.StartsWith('\'') || | ||
| 1414 | + input.Contains('$'); | ||
| 1415 | 1415 | ||
| 1416 | - if (startsWithDangerousToken) | ||
| 1417 | - { | ||
| 1418 | - // TODO add a debug message | ||
| 1419 | - return "REDACTED"; | ||
| 1420 | - } | ||
| 1421 | - | ||
| 1422 | - var ast = Parser.ParseInput( | ||
| 1423 | - input.ToString(), | ||
| 1424 | - out Token[] _, | ||
| 1425 | - out ParseError[] errors); | ||
| 1426 | - | ||
| 1427 | - if (errors.Length > 0) | ||
| 1428 | - { | ||
| 1429 | - return input; | ||
| 1430 | - } | ||
| 1431 | - | ||
| 1432 | - bool containsCode = false; | ||
| 1433 | - // we leave out n is CommandAst from here as to allow VMNames like svr19 to pass through without being redacted. | ||
| 1434 | - // Also could have used .Any() from Linq but I couldn't get that working. | ||
| 1435 | - foreach (var node in ast.FindAll( | ||
| 1436 | - n => | ||
| 1437 | - n is VariableExpressionAst || | ||
| 1438 | - n is ExpandableStringExpressionAst || | ||
| 1439 | - n is SubExpressionAst, | ||
| 1440 | - true)) | ||
| 1441 | - { | ||
| 1442 | - containsCode = true; | ||
| 1443 | - // TODO add a debug message | ||
| 1444 | - break; | ||
| 1445 | - } | ||
| 1446 | - | ||
| 1447 | - return containsCode | ||
| 1416 | + return startsWithOrContainsDangerousToken | ||
| 1448 | 1417 | ? "REDACTED" | |
| 1449 | 1418 | : input; | |
| 1450 | 1419 | } | |
| Back | FazBrowse Home | New Git URL |
0 commit comments