Replaced Invoke-Expression with Parser

[dunnryan]

Description

We were instructed to remove our usage of 'Invoke-Expression' because it is a security vulnerability. It has been replaced by a PowerShell AST parser that can robustly handle any valid Metadata input. I also added some tests to validate this helper function.

Mandatory Checklist

• Please choose the target release of Azure PowerShell. (⚠️Target release is a different concept from API readiness. Please click below links for details.)

  • General release
  • Public preview
  • Private preview
  • Engineering build
  • No need for a release

• Check this box to confirm: I have read the Submitting Changes section of CONTRIBUTING.md and reviewed the following information:

• SHOULD update ChangeLog.md file(s) appropriately
  • Update src/{{SERVICE}}/{{SERVICE}}/ChangeLog.md.
    • A snippet outlining the change(s) made in the PR should be written under the ## Upcoming Release header in the past tense.
  • Should not change ChangeLog.md if no new release is required, such as fixing test case only.
• SHOULD regenerate markdown help files if there is cmdlet API change. Instruction
• SHOULD have proper test coverage for changes in pull request.
• SHOULD NOT adjust version of module manually in pull request

[azure-client-tools-bot-prd]

Thanks for your contribution! The pull request validation has started. Please revisit this comment for updated status.

[Copilot]

Pull request overview

This pull request addresses a security vulnerability by replacing the use of Invoke-Expression with a PowerShell AST (Abstract Syntax Tree) parser for safely parsing metadata parameters in Policy cmdlets.

Changes:

• Replaced Invoke-Expression with AST-based parsing to eliminate security risks
• Added two new helper functions: Convert-AstLiteral and ConvertTo-HashtableSafely to safely parse PowerShell hashtable literals
• Added comprehensive test suite for the new parsing functionality

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 9 comments.

File	Description
src/Resources/Policy.Autorest/custom/Helpers.ps1	Added AST parser implementation with recursive literal conversion and safe hashtable parsing; replaced Invoke-Expression call with ConvertTo-HashtableSafely function
src/Resources/Policy.Autorest/test/ResolvePolicyMetadataParameter.Tests.ps1	Added new test file with test cases for simple and complex hashtable parsing, JSON parsing, file content parsing, and error handling

Comments suppressed due to low confidence (1)

src/Resources/Policy.Autorest/custom/Helpers.ps1:577

• The parameter is declared as $MetadataValue (line 550) with Pascal case, but it is referenced as $metadataValue with camel case throughout the function body (lines 554, 558, 562, 577). While PowerShell is case-insensitive for variable names, using inconsistent casing reduces code readability and maintainability. Use consistent casing throughout the function.

        $MetadataValue,
        [bool]$Debug = $false
    )

    if ($metadataValue -is [hashtable]) {
        return $metadataValue
    }

    if ([System.String]::IsNullOrEmpty($metadataValue)) {
        return $metadataValue
    }

    $metadata = (GetFileUriOrStringParameterValue $metadataValue).Trim()
    if ($debug) {
        Write-Host -ForegroundColor Cyan Metadata: $metadata
    }

    if ($metadata -like '@{*') {
        # probably a PSCustomObject, try converting to hashtable
        return ConvertTo-HashtableSafely $metadata
    }

    # otherwise it should be a JSON string
    if ($metadata -like '{*}') {
        return $metadata | ConvertFrom-JsonSafe -AsHashtable
    }

    throw "Unrecognized metadata format - value: [$($metadataValue)], type: [$($metadataValue.GetType())]"

[isra-fel]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 3 pipeline(s).

[isra-fel]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 3 pipeline(s).

[vidai-msft]

Please update the ChangeLog.md and fix the test errors.

[github-actions]

This PR was labeled "needs-revision" because it has unresolved review comments or CI failures.
Please resolve all open review comments and make sure all CI checks are green. Refer to our guide to troubleshoot common CI failures.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 7 comments.

[isra-fel]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 3 pipeline(s).

[isra-fel]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 3 pipeline(s).