Add -AsPlainText to ConvertFrom-SecureString (PowerShell#11142)

SteveL-MSFT · adityapatwardhan · commit 03f10f052d38 · 2019-12-11T15:40:41.000-08:00
diff --git a/src/Microsoft.PowerShell.Security/security/SecureStringCommands.cs b/src/Microsoft.PowerShell.Security/security/SecureStringCommands.cs
@@ -139,6 +139,12 @@ public SecureString SecureString
             }
         }
 
+        /// <summary>
+        /// Gets or sets a switch to get the secure string as plain text.
+        /// </summary>
+        [Parameter(ParameterSetName = "AsPlainText")]
+        public SwitchParameter AsPlainText { get; set; }
+
         /// <summary>
         /// Processes records from the input pipeline.
         /// For each input object, the command encrypts
@@ -165,6 +171,19 @@ protected override void ProcessRecord()
             {
                 encryptionResult = SecureStringHelper.Encrypt(SecureString, Key);
             }
+            else if (AsPlainText)
+            {
+                IntPtr valuePtr = IntPtr.Zero;
+                try
+                {
+                    valuePtr = Marshal.SecureStringToGlobalAllocUnicode(SecureString);
+                    exportedString = Marshal.PtrToStringUni(valuePtr);
+                }
+                finally
+                {
+                    Marshal.ZeroFreeGlobalAllocUnicode(valuePtr);
+                }
+            }
             else
             {
                 exportedString = SecureStringHelper.Protect(SecureString);
@@ -342,22 +361,8 @@ protected override void ProcessRecord()
                 }
                 else
                 {
-                    if (!Force)
-                    {
-                        string error =
-                            SecureStringCommands.ForceRequired;
-                        Exception e = new ArgumentException(error);
-                        WriteError(new ErrorRecord(e, "ImportSecureString_ForceRequired", ErrorCategory.InvalidArgument, null));
-                    }
-                    else
-                    {
-                        // The entire purpose of the SecureString is to prevent a secret from being
-                        // permanently stored in memory as a .Net string.  If they use the
-                        // -AsPlainText and -Force flags, they consciously have made the decision to be OK
-                        // with that.
-                        importedString = new SecureString();
-                        foreach (char currentChar in String) { importedString.AppendChar(currentChar); }
-                    }
+                    importedString = new SecureString();
+                    foreach (char currentChar in String) { importedString.AppendChar(currentChar); }
                 }
             }
             catch (ArgumentException e)
diff --git a/test/powershell/Modules/Microsoft.PowerShell.Security/SecureString.Tests.ps1 b/test/powershell/Modules/Microsoft.PowerShell.Security/SecureString.Tests.ps1
@@ -22,10 +22,11 @@ Describe "SecureString conversion tests" -Tags "CI" {
         $ss = ConvertTo-SecureString -AsPlainText -Force abcd
         $ss | Should -BeOfType SecureString
     }
+
     It "can convert back from a secure string" {
         $secret = "abcd"
         $ss1 = ConvertTo-SecureString -AsPlainText -Force $secret
-        $ss2 = convertfrom-securestring $ss1 | convertto-securestring
-        [pscredential]::New("user",$ss2).GetNetworkCredential().Password | Should -Be $secret
+        $ss2 = ConvertFrom-SecureString $ss1 | ConvertTo-SecureString
+        $ss2 | ConvertFrom-SecureString -AsPlainText | Should -Be $secret
     }
 }

Original file line number	Diff line number	Diff line change
`@@ -22,10 +22,11 @@ Describe "SecureString conversion tests" -Tags "CI" {`
`22`	`22`	`$ss = ConvertTo-SecureString -AsPlainText -Force abcd`
`23`	`23`	`$ss \| Should -BeOfType SecureString`
`24`	`24`	`}`
	`25`	`+`
`25`	`26`	`It "can convert back from a secure string" {`
`26`	`27`	`$secret = "abcd"`
`27`	`28`	`$ss1 = ConvertTo-SecureString -AsPlainText -Force $secret`
`28`		`- $ss2 = convertfrom-securestring $ss1 \| convertto-securestring`
`29`		`- [pscredential]::New("user",$ss2).GetNetworkCredential().Password \| Should -Be $secret`
	`29`	`+ $ss2 = ConvertFrom-SecureString $ss1 \| ConvertTo-SecureString`
	`30`	`+ $ss2 \| ConvertFrom-SecureString -AsPlainText \| Should -Be $secret`
`30`	`31`	`}`
`31`	`32`	`}`