Extension should support running in constrained language mode

[daviwil]

Right now we show an error message on startup of constrained language mode is turned on via AppLocker policy. We should do the necessary work to make the extension operate at some level with this mode turned on. The PowerShell ISE supports it.

[caparkaya]

Hello, is there an established roadmap, plan for this?

[TylerLeonhardt]

Closing this in favor of #754

[rjmholt]

I'm doing work now to move PSES over to a binary module to make this easier, but it looks like there are still issues because of how PSReadLine works. I'm not sure if those are the only issues, but that's the current blocker; we invoke a PSReadLine static method in PowerShell script directly for the prompt. So to enable constrained language mode, that's the next issue to solve.

[rjmholt]

Another facet here is that we have dependencies that aren't signed:

> ls .\module\PowerShellEditorServices\bin\Common\ | Get-AuthenticodeSignature | ? Status -eq 'NotSigned' | ft Status,Path

   Status Path
   ------ ----
NotSigned C:\Users\roholt\Documents\Dev\PowerShellEditorServices\module\PowerShellEditorServices\bin\Common\MediatR.dll
NotSigned C:\Users\roholt\Documents\Dev\PowerShellEditorServices\module\PowerShellEditorServices\bin\Common\MediatR.Extensions.Microsoft.DependencyInjectio…
NotSigned C:\Users\roholt\Documents\Dev\PowerShellEditorServices\module\PowerShellEditorServices\bin\Common\Microsoft.PowerShell.EditorServices.dll
NotSigned C:\Users\roholt\Documents\Dev\PowerShellEditorServices\module\PowerShellEditorServices\bin\Common\Newtonsoft.Json.dll
NotSigned C:\Users\roholt\Documents\Dev\PowerShellEditorServices\module\PowerShellEditorServices\bin\Common\OmniSharp.Extensions.DebugAdapter.dll
NotSigned C:\Users\roholt\Documents\Dev\PowerShellEditorServices\module\PowerShellEditorServices\bin\Common\OmniSharp.Extensions.DebugAdapter.Server.dll
NotSigned C:\Users\roholt\Documents\Dev\PowerShellEditorServices\module\PowerShellEditorServices\bin\Common\OmniSharp.Extensions.JsonRpc.dll
NotSigned C:\Users\roholt\Documents\Dev\PowerShellEditorServices\module\PowerShellEditorServices\bin\Common\OmniSharp.Extensions.LanguageProtocol.dll
NotSigned C:\Users\roholt\Documents\Dev\PowerShellEditorServices\module\PowerShellEditorServices\bin\Common\OmniSharp.Extensions.LanguageServer.dll
NotSigned C:\Users\roholt\Documents\Dev\PowerShellEditorServices\module\PowerShellEditorServices\bin\Common\Serilog.dll
NotSigned C:\Users\roholt\Documents\Dev\PowerShellEditorServices\module\PowerShellEditorServices\bin\Common\Serilog.Extensions.Logging.dll
NotSigned C:\Users\roholt\Documents\Dev\PowerShellEditorServices\module\PowerShellEditorServices\bin\Common\Serilog.Sinks.Async.dll
NotSigned C:\Users\roholt\Documents\Dev\PowerShellEditorServices\module\PowerShellEditorServices\bin\Common\Serilog.Sinks.Console.dll
NotSigned C:\Users\roholt\Documents\Dev\PowerShellEditorServices\module\PowerShellEditorServices\bin\Common\Serilog.Sinks.File.dll
NotSigned C:\Users\roholt\Documents\Dev\PowerShellEditorServices\module\PowerShellEditorServices\bin\Common\UnixConsoleEcho.dll

[TylerLeonhardt]

@rjmholt I believe there's a way for us to sign things as "external deps" but need to do the research.

[romero126]

Has there been any additional update on this? I am fairly interested in a desirable outcome from this.

[TylerLeonhardt]

We talked offline but to capture it here as well...

First comment out this line so you can actually test this:
https://github.com/PowerShell/PowerShellEditorServices/blob/d8fc936bea002b897046e6e4952ae2c837216aa8/src/PowerShellEditorServices.Hosting/EditorServicesLoader.cs#L190

Then see where it breaks with ConstrainedLanguage mode turned on...

Here is a good list to start:​​​​

These are hits for ]:: in PowerShellEditorServices. Any method invocations will have to either be done a different way, or wrapped in a binary cmdlet.

[dkattan]

Has anyone started working on this? I'd also love for this to work and can contribute if there is an existing branch.

[TylerLeonhardt]

Hi @dkattan I don't think anyone is actively working on this. Are you interested in getting involved?

My steps in the comment above yours are still accurate. The way I'd approach this is:

• uncomment the code I mention above
• try to start up with constrainedlanguage mode
• see what goes sideways and try to fix them

You're more than willing to drop any questions you have here.

Once start up works, we can get a PR out to support this... then we can start filling in what doesn't work (like the expand alias feature, remoting feature etc)

[TylerLeonhardt]

ConstrainedLanguage mode is now supported in the PowerShell Preview extension.

[craig-martin]

Exciting! This should allow us to use it on admin workstations where constrained language mode is enforced.

[nyannios]

Well add me to this too! The security gestapos have everything locked up here and I am getting this too
[ ](url

)

[TylerLeonhardt]

@nyannios what version of PowerShell are you using? The PowerShell extension only supports v5.1 and higher.

[nyannios]

Hey, I downloaded and installed PowerShell 7 for windows and now it's working! Thanks! I was on 4.0