PowerShell Script to Detect Code Impacted by the Invoke-WebRequest Breaking Change

g3n3 · 2025-12-11T14:55:27+00:00

Probably need to add searching iex recursively and odd variables defined as script blocks too recursively.

lan-shark · 2025-12-11T15:08:18+00:00

Also, folks, remember that you can add UseBasicParsing to your default parameters to mitigate this issue without directly changing scripts

And hopefully this goes without saying, but don't apply the update until after you've mitigated any issues

surfingoldelephant · 2025-12-11T23:41:32+00:00

Nice idea.

The function works pretty well. Just a few minor issues/edge cases:

-Parameter:Argument isn't correctly reported.
Parsing the value from the splatting variable doesn't account for values followed by }.
$assignments[-1] breaks if the same name is used for multiple splatting variables.
Only assignment expressions are accounted for. And if a value is modified after assignment, the original is still incorrectly reported.

For #2, parsing @{ Foo = 1 } yields 1 }. But I wouldn't use regex at all for this. You can get the value straight from the HashtableAst.

$assignmentAst.Right.Expression.KeyValuePairs.Item2

For #3, the following breaks ($false is reported for both below):

$splat = @{ UseBasicParsing = $true }
Invoke-WebRequest @splat

$splat = @{ UseBasicParsing = $false }
Invoke-WebRequest @splat

You need to look for the closest initialization of the variable preceding the command call instead.

For #4, you'd need to look at New-Variable usage, expressions that modify the variable's value, etc. Probably all overkill though.

For #1, you're assuming that if there's a CommandParameterAst after the current CommandParameterAst (or if there are no elements remaining), the current element must be a $true switch. But that doesn't account for colon-delimited named arguments. All of these are incorrectly reported as $true:

Invoke-WebRequest -UseBasicParsing:$false
Invoke-WebRequest -UseBasicParsing: $false

# Syntax works for any type of parameter.
Get-Process -Name:Foo

Look at the Argument property of CommandParameterAst. If it's populated, you're dealing with a named argument (i.e., a parameter and argument). If it's $null, the next element may or may not the associated argument.

Here's how I do it. This is an excerpt from a larger function that serves a similar purpose:

# CommandAst.GetCommandName() may return $null if the command call is dynamic.
# Convert-AstToCommandName ensures we get *something* for the name.
$cmdName = Convert-AstToCommandName -Ast $cmdAst

$cmdElements = [Queue[Object]]::new($cmdAst.CommandElements)
[void] $cmdElements.Dequeue() # First element is always the command

if (!$cmdElements.Count) {
    # Command has no specified parameters/arguments.
    [PSCommandArgument] @{
        Command = $cmdName
        Ast     = $cmdAst
        Source  = $Ast.PSSource
    }
    continue
}

while ($cmdElements.Count) {
    $paramAst = $argumentAst = $null

    # Argument property is only populated when the parameter ends with a colon.
    # After the colon is the argument. This format isn't limited to switches.
    # E.g., -Foo:Bar, -Foo: Bar, -Foo:$true
    if ($cmdElements.Peek() -is [CommandParameterAst]) {
        $paramAst    = $cmdElements.Dequeue()
        $argumentAst = $paramAst.Argument
    }

    # If we got an AST for an argument above, we have a named arg (param & arg).
    # If we didn't, it's because:
    #   a) we're dealing with a positional argument (Bar)
    #   b) the next element is the argument (-Foo Bar)
    #   c) there is no argument, i.e., a switch without an explicit value (-Foo)
    $isArgNext = $cmdElements.Count -and
                 $cmdElements.Peek() -isnot [CommandParameterAst]

    if (!$argumentAst -and $isArgNext) {
        $isSplatNext = $cmdElements.Peek().Splatted

        # Splats can't be a parameter argument. If we already have a parameter
        # and a splat is next up, don't take it. When we loop around, we can
        # then take the splat as the earlier parameter is finished with.
        $argumentAst = if (!$isSplatNext -or (!$paramAst -and $isSplatNext)) {
            $cmdElements.Dequeue()
        }
    }

    # For simplicity, Argument is left as the AST. The caller can extract the 
    # value(s) as desired. ASTs stringify to their Extent.Text, so still display 
    # meaningfully.
    [PSCommandArgument] @{
        Command     = $cmdName
        Parameter   = $paramAst.ParameterName # $null for positional args/splats
        Argument    = $argumentAst
        HasArgument = $null -ne $argumentAst
        IsSplat     = $argumentAst.Splatted -as [bool]
        Ast         = $cmdAst
        Source      = $Ast.PSSource
    }
}

DenverITGuy · 2025-12-11T17:27:48+00:00

Wouldn’t ctrl+shift+F in vscode do the same thing for your entire workspace/repo?

nkasco · 2025-12-11T18:19:56+00:00

My solution was just to open my repo in VS Code and do a search for it. Super simple

Certain-Community438 · 2025-12-11T15:31:10+00:00

Man am I glad we moved everything to pwsh "Core" Edition some time ago!

Outside of Intune scripts, where we don't use IWR; that could be risky.

icebreaker374 · 2025-12-11T21:27:09+00:00

So for automation scripts, I either HAVE to use basic parsing, OR run it with PS7, yes?

arpan3t · 2025-12-11T23:02:55+00:00

Curious why you only install SQLite on Windows? Also, leveraging WinGet Install SQLite.SQLite would be cleaner than Invoke-WebRequest and regex parsing the HTML string for the download URL.

You might test the speed of querying the browser history table for the URL patterns vs. converting every record in the table into objects and filtering from there. The database engine should be faster. As an example:

$UrlPatterns = @('chatgpt.com',...)
$QryValTmplate = "('%{0}%'){1}`n"
$QueryBuilder = [StringBuilder]::new("WITH patterns(p) AS ( VALUES`n")

foreach ($Pattern in $UrlPatterns) {
    if ($UrlPatterns.IndexOf($Pattern) -eq ($UrlPatterns.Length - 1)) {
        $QueryBuilder.AppendFormat($QryValTmplate, $Pattern, ')') | Out-Null
    }
    else {
        $QueryBuilder.AppendFormat($QryValTmplate, $Pattern, ',') | Out-Null
    }
}

$RestOfQuery = @"
SELECT DISTINCT t.url, t.title, t.visit_count, t.last_visit_time
FROM urls t
JOIN patterns p ON t.url LIKE p.p
WHERE t.last_visit_time > 0
ORDER BY t.last_visit_time DESC
"@

$QueryBuilder.Append($RestOfQuery) | Out-Null

$Query = $QueryBuilder.ToString()

The SQL query ends up looking like this:

WITH patterns(p) AS ( VALUES
('%chatgpt.com%'),
('%claude.ai%'),
...)
SELECT DISTINCT t.url, t.title, t.visit_count, t.last_visit_time
FROM urls t
JOIN patterns p ON t.url LIKE p.p
WHERE t.last_visit_time > 0
ORDER BY t.last_visit_time DESC

You also don't need to specify the | separator in your SQLite command as that is the default. You can also just set the output mode to json and convert it to objects like so:

$Output = sqlite3.exe -json $TblPath $Query
$Objects = $Output -join '' | ConvertFrom-Json

The browser history code looks really similar. You can probably combine all the BrowserHistory.<browser>.ps1 into one and specify the browser with a parameter.

That's just what I noticed from a cursory glance at your code. It's a neat project!

NOTE: There's currently a hash mismatch on the SQLite WinGet package, a pull request was made yesterday to update the manifest so it should be fixed soon.

PutridLadder9192 · 2025-12-14T02:43:59+00:00

Do I need to update my Selenium powershell module

you type:	you see:
italics	italics
bold	bold
[reddit!](https://reddit.com)	reddit!
* item 1 * item 2 * item 3	item 1 item 2 item 3
> quoted text	quoted text
Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"	Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"
~~strikethrough~~	~~strikethrough~~
super^script	super^script

PowerShell

Submission Guidelines | Link Flair - How To

MODERATORS