Skip to content

Commit ebccafb

Browse files
Fix potential erroneous load of assembly
This change makes the assembly resolve handler be more strict when checking whether or not to load the YamlDotNet assembly. This should prevent accidentally loading the YamlDotNet assembly as a result of a request coming from another assembly that is looking to load a different assembly. Signed-off-by: Gabriel Adrian Samfira <gsamfira@cloudbasesolutions.com>
1 parent 18c7894 commit ebccafb

1 file changed

Lines changed: 2 additions & 5 deletions

File tree

powershell-yaml.psm1

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ function Invoke-LoadFile {
3434
[string]$assemblyPath
3535
)
3636

37-
$global:powershellYamlDotNetAssemblyPath = Join-Path $assemblyPath "YamlDotNet.dll"
37+
$powershellYamlDotNetAssemblyPath = Join-Path $assemblyPath "YamlDotNet.dll"
3838
$serializerAssemblyPath = Join-Path $assemblyPath "PowerShellYamlSerializer.dll"
3939
$yamlAssembly = [Reflection.Assembly]::LoadFile($powershellYamlDotNetAssemblyPath)
4040
$serializerAssembly = [Reflection.Assembly]::LoadFile($serializerAssemblyPath)
@@ -47,20 +47,17 @@ function Invoke-LoadFile {
4747
# Load YamlDotNet if it's requested by PowerShellYamlSerializer. Ignore other requests as they might
4848
# originate from other assemblies that are not part of this module and which might have different
4949
# versions of the module that they need to load.
50-
if ($e.Name -like "*YamlDotNet*" -and $e.RequestingAssembly -like "*PowerShellYamlSerializer*" ) {
50+
if ($e.Name -match "^YamlDotNet,*" -and $e.RequestingAssembly.Location -eq $serializerAssemblyPath) {
5151
return [System.Reflection.Assembly]::LoadFile($powershellYamlDotNetAssemblyPath)
5252
}
5353

5454
return $null
5555
})
5656
# Load the StringQuotingEmitter from PowerShellYamlSerializer to force the resolver handler to fire once.
57-
# This will load the YamlDotNet assembly and expand the global variable $powershellYamlDotNetAssemblyPath.
58-
# We then remove it to avoid polluting the global scope.
5957
# This is an ugly hack I am not happy with.
6058
$serializerAssembly.GetType("StringQuotingEmitter") | Out-Null
6159
}
6260

63-
Remove-Variable -Name powershellYamlDotNetAssemblyPath -Scope Global
6461
return @{ "yaml"= $yamlAssembly; "quoted" = $serializerAssembly }
6562
}
6663

0 commit comments

Comments
 (0)