Move regex-based History exclusion to AST-based to play nice with SecretMangement

[TylerLeonhardt]

Description of the new feature/enhancement

Because every command in SecretManagement has Secret in the name, every command invocation gets excluded from history. This isn't a good experience especially since SecretManagement is helping with the "secrets not in plaintext" situation.

Here are some examples that would be nice to have in history:

Get-Secret PSGalleryApiKey -AsPlainText

Publish-Module -Name Foo -NuGetApiKey (Get-Secret PSGalleryApiKey -AsPlainText)

However, we need to make sure that something like this still gets excluded:

Get-ResultFromTwoSecrets -Secret1 (Get-Secret -Name blah -AsPlainText) -Secret2 sdv87ysdfayf798hfasd8f7ha

Proposed technical implementation details (optional)

This regex based filter:

PSReadLine/PSReadLine/History.cs

Line 115 in fd99806

"password|asplaintext|token|apikey|secret",

should be AST based and play nice with an exclusion list.

[daxian-dbw]

Also got feedback from @LeeHolmes about the regex used to filter out sensitive command lines:

It looks like this is the list that SpecterOps uses to dig through command line history for sensitive content:

Seatbelt/PowerShellHistory.cs at master · GhostPack/Seatbelt · GitHub
Seatbelt/MiscUtil.cs at cc3bde6a528cffe9dbc613906cc6d9b68278367a · GhostPack/Seatbelt · GitHub

I didn’t realize how many tools supported “/p ” and “-p ” and variants.

Should we update this? PSReadLine/History.cs at fd1265e · PowerShell/PSReadLine · GitHub

[iSazonov]

Maybe add an attribute to sensitive parameters? This could helps to filter. Also we could not filter whole command string but only sensitive argument.

[bwright86]

I've been using Lee's suggested regex for a while, and I noticed it is a bit aggressive, not just with "Secret", but even if I pass a [PSCredential] object, it still gets yanked.

I think the scenario for the regex pattern is for parameters that accept a plaintext string of tokens/passwords/secret.

I think AST parsing is probably the best way to go, so you know if a string is passed.

But for now, i have modified the regex a little bit to explicitly look for a parameter and the start of a string:
$sensitive = "\b-.(password|asplaintext|token|key|secret).\b\s+[`"|']"

This appears to be less aggressive, and still removes plaintext strings, but allows for variables to be used and history kept.

🎉 This issue was addressed in 2921, which has now been successfully released in v2.2.0-beta4. 🎉