Skip to content

Latest commit

 

History

History
27 lines (16 loc) · 522 Bytes

AvoidUsingInvokeExpression.md

File metadata and controls

27 lines (16 loc) · 522 Bytes

AvoidUsingInvokeExpression

Severity Level: Warning

Description

Care must be taken when using the Invoke-Expression command. The Invoke-Expression executes the specified string and returns the results.

Code injection into your application or script can occur if the expression passed as a string includes any data provided from the user.

How

Remove the use of Invoke-Expression.

Example

Wrong

Invoke-Expression "Get-Process"

Correct

Get-Process