GoodEnoughRules/tests/Measure-InvokeWebRequestWithoutBasic.tests.ps1 at main · HeyItsGilbert/GoodEnoughRules · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
Describe 'Measure-InvokeWebRequestWithoutBasic' {
    BeforeAll {
        if ( -not $env:BHPSModuleManifest ) {
            Set-BuildEnvironment -Path "$PSScriptRoot\.." -Force
        }
        $manifest = Import-PowerShellDataFile -Path $env:BHPSModuleManifest
        $outputDir = Join-Path -Path $env:BHProjectPath -ChildPath 'Output'
        $outputModDir = Join-Path -Path $outputDir -ChildPath $env:BHProjectName
        $outputModVerDir = Join-Path -Path $outputModDir -ChildPath $manifest.ModuleVersion
        $script:outputModVerModule = Join-Path -Path $outputModVerDir -ChildPath "$($env:BHProjectName).psm1"
        $outputModVerManifest = Join-Path -Path $outputModVerDir -ChildPath "$($env:BHProjectName).psd1"

        # Get module commands
        # Remove all versions of the module from the session. Pester can't handle multiple versions.
        Get-Module $env:BHProjectName | Remove-Module -Force -ErrorAction Ignore
        Import-Module -Name $outputModVerManifest -Verbose:$false -ErrorAction Stop
    }

    Context 'When Invoke-WebRequest is used without UseBasicParsing' {
        It 'Detects Invoke-WebRequest without UseBasicParsing' {
            $fakeScript = @"
Invoke-WebRequest -Uri 'https://example.com'
"@
            $ast = [System.Management.Automation.Language.Parser]::ParseInput($fakeScript, [ref]$null, [ref]$null)
            $result = Measure-InvokeWebRequestWithoutBasic -ScriptBlockAst $ast
            $result.Count | Should -BeExactly 1
            $result[0].Message | Should -Be 'Invoke-WebRequest should be used with the UseBasicParsing parameter.'
            $result[0].Severity | Should -Be 'Error'
        }

        It 'detects Invoke-WebRequest without UseBasicParsing in different formatting' {
            $file = "$PSScriptRoot\fixtures\ExampleFunction.ps1"
            $invokeScriptAnalyzerSplat = @{
                Path = $file
                IncludeRule = 'Measure-InvokeWebRequestWithoutBasic'
                CustomRulePath = $script:outputModVerModule
            }

            $result = Invoke-ScriptAnalyzer @invokeScriptAnalyzerSplat
            $result.Count | Should -BeExactly 2
            $result[0].Message | Should -Be 'Invoke-WebRequest should be used with the UseBasicParsing parameter.'
            $result[0].Severity | Should -Be 'Error'
            $result[0].Line | Should -Be 6
            $result[1].Message | Should -Be 'Invoke-WebRequest should be used with the UseBasicParsing parameter.'
            $result[1].Severity | Should -Be 'Error'
        }

        It 'Detects iwr alias without UseBasicParsing' {
            $fakeScript = @"
iwr -Uri 'https://example.com'
"@
            $ast = [System.Management.Automation.Language.Parser]::ParseInput($fakeScript, [ref]$null, [ref]$null)
            $result = Measure-InvokeWebRequestWithoutBasic -ScriptBlockAst $ast
            $result.Count | Should -BeExactly 1
            $result[0].Message | Should -Be 'Invoke-WebRequest should be used with the UseBasicParsing parameter.'
        }

        It 'Detects curl alias without UseBasicParsing' {
            $fakeScript = @"
curl 'https://example.com'
"@
            $ast = [System.Management.Automation.Language.Parser]::ParseInput($fakeScript, [ref]$null, [ref]$null)
            $result = Measure-InvokeWebRequestWithoutBasic -ScriptBlockAst $ast
            $result.Count | Should -BeExactly 1
            $result[0].Message | Should -Be 'Invoke-WebRequest should be used with the UseBasicParsing parameter.'
        }

        It 'Does not detect curl.exe usage' {
            $fakeScript = @"
curl.exe 'https://example.com'
"@
            $ast = [System.Management.Automation.Language.Parser]::ParseInput($fakeScript, [ref]$null, [ref]$null)
            $result = Measure-InvokeWebRequestWithoutBasic -ScriptBlockAst $ast
            $result.Count | Should -Be 0
        }
    }

    Context 'When Invoke-WebRequest is used with UseBasicParsing' {
        It 'Does not flag Invoke-WebRequest with UseBasicParsing' {
            $fakeScript = @"
Invoke-WebRequest -Uri 'https://example.com' -UseBasicParsing
"@
            $ast = [System.Management.Automation.Language.Parser]::ParseInput($fakeScript, [ref]$null, [ref]$null)
            $result = Measure-InvokeWebRequestWithoutBasic -ScriptBlockAst $ast
            $result.Count | Should -Be 0
        }

        It 'Does not flag iwr alias with UseBasicParsing' {
            $fakeScript = @"
iwr -Uri 'https://example.com' -UseBasicParsing
"@
            $ast = [System.Management.Automation.Language.Parser]::ParseInput($fakeScript, [ref]$null, [ref]$null)
            $result = Measure-InvokeWebRequestWithoutBasic -ScriptBlockAst $ast
            $result.Count | Should -Be 0
        }
    }

    Context 'Multiple commands in script' {
        It 'Detects multiple violations in same script' {
            $fakeScript = @"
Invoke-WebRequest -Uri 'https://example.com'
iwr 'https://test.com'
curl 'https://another.com'
"@
            $ast = [System.Management.Automation.Language.Parser]::ParseInput($fakeScript, [ref]$null, [ref]$null)
            $result = Measure-InvokeWebRequestWithoutBasic -ScriptBlockAst $ast
            $result.Count | Should -BeExactly 3
        }

        It 'Does not flag non-Invoke-WebRequest commands' {
            $fakeScript = @"
Write-Host 'Hello, World!'
Get-Process
Invoke-RestMethod -Uri 'https://example.com'
"@
            $ast = [System.Management.Automation.Language.Parser]::ParseInput($fakeScript, [ref]$null, [ref]$null)
            $result = Measure-InvokeWebRequestWithoutBasic -ScriptBlockAst $ast
            $result.Count | Should -Be 0
        }
    }
}