Function checkAddType

src/tools/PowerShellTool/powershellSecurity.ts:321–331

* Checks for Add-Type usage which compiles and loads .NET code at runtime. * This can be used to execute arbitrary compiled code.

(
  parsed: ParsedPowerShellCommand,
)

 * This can be used to execute arbitrary compiled code.
 */
function checkAddType(
  parsed: ParsedPowerShellCommand,
): PowerShellSecurityResult {
  if (hasCommandNamed(parsed, 'Add-Type')) {
    return {
      behavior: 'ask',
      message: 'Command compiles and loads .NET code',
    }
  }
  return { behavior: 'passthrough' }
}

/**
 * Checks for New-Object -ComObject. COM objects like WScript.Shell,