Skip to content

Fix the TPA in a more reliable way - #115

Open
Dongbo Wang (daxian-dbw) wants to merge 1 commit into
PowerShell:masterfrom
daxian-dbw:tpa
Open

Dongbo Wang (daxian-dbw) wants to merge 1 commit into
PowerShell:masterfrom
daxian-dbw:tpa

Conversation

@daxian-dbw

@daxian-dbw Dongbo Wang (daxian-dbw) commented Sep 14, 2026

Copy link
Copy Markdown
Member

PR Summary

Fix #114

Replace the hard-coded Trusted Platform Assemblies (TPA) allow-list used by pwrshplugin.dll with a deny-list constructed from the DLLs installed alongside .NET runtime.

Motivation

The set of trusted platform assemblies differs across supported PowerShell versions, including 7.4, 7.5, and 7.6. Maintaining an explicit allow-list causes the WinRM hosting code to fall out of sync as assemblies are added, removed, or renamed.

Comparing TRUSTED_PLATFORM_ASSEMBLIES from pwsh.exe with the DLLs under $PSHOME showed that the TPA list is consistently the set of installed DLLs minus a relatively stable group of native and host binaries.

Changes

  • Enumerate *.dll files immediately under coreCLRDirectoryPath.
  • Include each discovered DLL in the TPA list unless it is a known native or host binary.
  • Match deny-list entries case-insensitively.
  • Exclude files beginning with mscordaccore_ to account for architecture- and version-specific filenames.
  • Exclude Microsoft.PowerShell.GraphicalHost.dll, which is not usable in a remoting session.
  • Include other PowerShell managed assemblies in the TPA list.
  • Remove the obsolete .ni.dll probing logic because modern PowerShell distributions no longer include native-image assemblies.
  • Add FindFirstFileA, FindNextFileA, and FindClose to the existing system-call facade so directory enumeration follows the current dependency-injection design.

This makes TPA construction resilient to assembly changes across PowerShell and .NET servicing releases while retaining a small, stable deny-list.

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

@daxian-dbw

Copy link
Copy Markdown
Member Author

/azp run

@azure-pipelines

Copy link
Copy Markdown
Commenter does not have sufficient privileges for PR 115 in repo PowerShell/PowerShell-Native

@adityapatwardhan

Copy link
Copy Markdown
Member

/azp run

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 1 pipeline(s).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

System.IO.Pipelines missing from the TRUSTED_PLATFORM_ASSEMBLIES array

2 participants