René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Rule Request: `AvoidPlaintextParameterPasswords`","articleBody":"Similar to the rule [`AvoidUsingPlainTextForPassword`](https://learn.microsoft.com/powershell/utility-modules/psscriptanalyzer/rules/avoidusingplaintextforpassword), passing plaintext passwords to external/binary cmdlets should be avoided.\n\nThis includes cmdlets as e.g.:\n```PowerShell\nPS C:\\\u003e Get-Command -ParameterName Password\n\nCommandType     Name                                               Version    Source\n-----------     ----                                               -------    ------\nFunction        Register-ScheduledTask                             1.0.0.0    ScheduledTasks\nFunction        Set-ScheduledTask                                  1.0.0.0    ScheduledTasks\n```\n\nBut could potentially any imported (binary) cmdlet with a [bound parameter](https://stackoverflow.com/a/79634016/1701026) named `Password` and of type `String`\nKnowing that the `AvoidUsingPlainTextForPassword` rule might not capture the security risk when using a different variable name (e.g. `-Password $Wachtwoord`) or a password that is statically provided:\n\n```PowerShell\nInvoke-ScriptAnalyzer -ScriptDefinition {\nSet-ScheduledTask -TaskName 'SoftwareScan' -Trigger $Time -User 'User' -Password 'P@ssw0rd'\n}.ToString()\n```\n\nRelated:\n- Rule request: AvoidSecureStringDisclosure #1997\n- PowerShell issue: https://github.com/PowerShell/PowerShell/issues/26366 and https://github.com/PowerShell/PowerShell/issues/16502\n- Document issue: https://github.com/MicrosoftDocs/windows-powershell-docs/issues/4051","author":{"url":"https://github.com/iRon7","@type":"Person","name":"iRon7"},"datePublished":"2025-11-03T19:31:42.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/2139/PSScriptAnalyzer/issues/2139"}