Allow saving command to history file if it reads a property with a sensitive name

[KalleOlaviNiemitalo]

Prerequisites

• Write a descriptive title.

Description of the new feature/enhancement

If I run this command, then PSReadLine does not save it to the history file by default, because of the sensitive name Password:

(Import-Clixml "${Env:HOME}\credential.clixml").GetNetworkCredential().Password | Set-Clipboard

However, the command itself does not contain any passwords. I would like PSReadLine to save this command to the history file so that I can more easily run similar commands in future PowerShell sessions.

Proposed technical implementation details (optional)

The existing implementation of [Microsoft.PowerShell.PSConsoleReadLine]::GetDefaultAddToHistoryOption considers Password a sensitive name and returns MemoryOnly, which prevents PSReadLine from saving the command to the history file. innerAst is a StringConstantExpressionAst with StringConstantType : BareWord. Its parent is a MemberExpressionAst, the grandparent is a CommandExpressionAst, and the great grandparent is a PipelineAst.

I imagine the heuristic could be changed to allow a MemberExpressionAst in which the name of the member is sensitive, if it is not at the left side of an assignment operator like $shield.Password = "12345". The VariableExpressionAst case already checks IsOnLeftSideOfAnAssignment.

[KalleOlaviNiemitalo]

On the other hand, "12345" in $obj.SetPassword("12345") should be treated as a password. Does this likewise have a MemberExpressionAst in its parse tree?

[H0R5E]

I have a similar issue calling a command that passes (the name of) environment variables that contain secrets, like so:

act -j build-demo -s AWS_ACCESS_KEY_ID -s AWS_SECRET_ACCESS_KEY -s PULUMI_ACCESS_TOKEN

I don't see this as being a sensitive command as the secrets are not exposed.

yes this is really annoying. please have some kind of configuration to prevent filtering the history. I dont need PSReadLine to babysit my history for me.

[KalleOlaviNiemitalo]

@4cq2, it's already configurable. See #3243 (comment), Set-PSReadLineOption -AddToHistoryHandler. This issue is about changing the default behaviour to detect more cases in which the command line includes something sensitive-looking but can be analysed as safe.

@KalleOlaviNiemitalo thank goodness. I have dealt with that annoyance for so long. thank you