Password shown in plaintext

[benwa]

Bug description

If you exclude both the -Username and -Password parameters, the module will prompt for both, but the password is obfuscated, as expected. If, however, you pass the -Username without the -Password parameter, the module will prompt for the password. That prompt is in plaintext.

Command-line input

New-AsBuiltReport -Report Microsoft.Windows -Target localhost -OutputFolderPath . -Filename example -Username bennett

Steps to reproduce

1. Create a new AsBuiltReport while passing the -Username parameter. Do not pass the -Password parameter.
2. Observe that the module prompts for the password, but the input is in plaintext.

Expected behaviour

The password is hidden

Screenshots

Operating System

Windows 11 24H2

PowerShell Version

Name                           Value
----                           -----
PSVersion                      7.4.6
PSEdition                      Core
GitCommitId                    7.4.6
OS                             Microsoft Windows 10.0.26100
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

and

Name                           Value
----                           -----
PSVersion                      5.1.26100.2161
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.26100.2161
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

PowerShell Modules

Name               Version
----               -------
AsBuiltReport.Core 1.4.1
PScribo            0.10.0

Additional Context

No response

Before submitting

• I have read and followed the bug reporting guidelines.
• I have read the documentation, and referred to the known issues before submitting this bug report.
• I have checked for previously opened & closed issues before submitting this bug report.

[alagoutte]

Hi Benwa,

Yes, -password parameter is String and not SecureString (Historic reason ? @tpcarman)

if you don't use -username or -password, it is Get-credential prompt used....

i can be change but i will break compability....

[tpcarman]

Hmm.. I'm a creature of habit and have always stored credentials using Get-Credential, so I've never encountered this issue.

@benwa Thanks for raising this issue. I'll take a look.

[tpcarman]

Yes, -password parameter is String and not SecureString (Historic reason ? @tpcarman)

Correct, PowerShell cannot automatically convert a string (e.g. "Password123") to a secure string within the parameter block. Changing the Password parameter from [String] to [SecureString] would change the current functionality and force users to present their password as a secure string instead. This would cause a breaking change and likely lead to confusion for existing users who are already happy providing a Password in plain text. For users who want a more secure method, there is the option to use the Credential parameter and provide a PSCredential object instead.

However, after looking at this issue more closely, there was an opportunity to improve the code so that if the Username parameter is used without the Password parameter, the user will now be prompted for the password in a more secure fashion. When prompted, the password will now be obfuscated and captured as a secure string.

[tpcarman]

@alagoutte @rebelinux @benwa Try the latest commit in the dev branch and let me know if all is OK? If all is good then I will publish the updates.

[rebelinux]

I did several tests and so far everything works fine!

PS C:\Users\jocolon> New-AsBuiltReport -Report Veeam.VBR -Target veeam-vbr.domain.local -AsBuiltConfigFilePath C:\Users\jocolon\AsBuiltReport\AsBuiltReport.json -OutputFolderPath C:\Users\jocolon\AsBuiltReport\ -Format HTML -ReportConfigFilePath C:\Users\jocolon\AsBuiltReport\AsBuiltReport.Veeam.VBR.json -EnableHealthCheck -Username administrator@domain.local

Password for user administrator@domain.local: ********