-
Notifications
You must be signed in to change notification settings - Fork 8.2k
AMSI scan should be done outside the static lock #3919
Copy link
Copy link
Closed
Labels
Issue-BugIssue has been identified as a bug in the productIssue has been identified as a bug in the productIssue-Code Cleanupthe issue is for cleaning up the code with no impact on functionalitythe issue is for cleaning up the code with no impact on functionalityResolution-No ActivityIssue has had no activity for 6 months or moreIssue has had no activity for 6 months or moreSize-DaysWG-Enginecore PowerShell engine, interpreter, and runtimecore PowerShell engine, interpreter, and runtimeWG-Engine-Performancecore PowerShell engine, interpreter, and runtime performancecore PowerShell engine, interpreter, and runtime performance
Description
Currently our AMSI code (https://github.com/PowerShell/PowerShell/blob/master/src/System.Management.Automation/security/SecuritySupport.cs#L1672) calls the AmsiScanString() method within a static lock.
This is unnecessary because the AMSI API is thread safe and designed to process multiple scan requests.
But this code also needs to be refactored because it is unnecessarily un-initializing and re-initializing AMSI when multiple runspaces are used. In addition it is not tracking pipeline sessions correctly for multiple runspaces.
So I see the work items as:
- Ensure AMSI is initialized and un-initialized only once (see related issue Transcription for the host stops, when ANY runspace in the host get closed #2334).
- Add concurrent dictionary to correctly track AMSI session per pipeline.
- Don't call AmsiScanString within the static lock.
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
Issue-BugIssue has been identified as a bug in the productIssue has been identified as a bug in the productIssue-Code Cleanupthe issue is for cleaning up the code with no impact on functionalitythe issue is for cleaning up the code with no impact on functionalityResolution-No ActivityIssue has had no activity for 6 months or moreIssue has had no activity for 6 months or moreSize-DaysWG-Enginecore PowerShell engine, interpreter, and runtimecore PowerShell engine, interpreter, and runtimeWG-Engine-Performancecore PowerShell engine, interpreter, and runtime performancecore PowerShell engine, interpreter, and runtime performance