Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
---
description: Avoid semicolons as line terminators
ms.date: 06/28/2023
ms.date: 06/01/2026
ms.topic: reference
title: AvoidSemicolonsAsLineTerminators
---
Expand All @@ -10,14 +10,14 @@ title: AvoidSemicolonsAsLineTerminators

## Description

Lines should not end with a semicolon.

> [!NOTE]
> This rule is not enabled by default. The user needs to enable it through settings.
Avoid using semicolons at the end of lines. In PowerShell, line-ending semicolons are redundant and
detract from code readability. Although semicolons serve as statement separators on a single line,
using them as line terminators is discouraged. This rule promotes cleaner, more maintainable code by
removing unnecessary semicolons. This rule isn't enabled by default.

## Example

### Wrong
### Noncompliant

```powershell
Install-Module -Name PSScriptAnalyzer; $a = 1 + $b;
Expand All @@ -28,7 +28,7 @@ Install-Module -Name PSScriptAnalyzer;
$a = 1 + $b
```

### Correct
### Compliant

```powershell
Install-Module -Name PSScriptAnalyzer; $a = 1 + $b
Expand All @@ -43,14 +43,18 @@ $a = 1 + $b

```powershell
Rules = @{
PSAvoidSemicolonsAsLineTerminators = @{
Enable = $true
PSAvoidSemicolonsAsLineTerminators = @{
Enable = $true
}
}
```

### Parameters
## Parameters

### Enable

Enables (`$true`) the rule during ScriptAnalyzer invocation.

#### Enable: bool (Default value is `$false`)
### Disable

Enable or disable the rule during ScriptAnalyzer invocation.
Disables (`$false`) the rule during ScriptAnalyzer invocation. Default value is `$false`.
Comment thread
Xelu86 marked this conversation as resolved.
Comment on lines +54 to +60
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As with the other PRs, recommend reverting this structure since the rule doesn't have a Disable parameter.

Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
---
description: Avoid Using ShouldContinue Without Boolean Force Parameter
ms.date: 06/28/2023
ms.date: 06/01/2026
ms.topic: reference
title: AvoidShouldContinueWithoutForce
---
Expand All @@ -10,18 +10,16 @@ title: AvoidShouldContinueWithoutForce

## Description

Functions that use ShouldContinue should have a boolean force parameter to allow user to bypass it.
Functions that use `ShouldContinue` should have a boolean `Force` parameter to allow users to bypass
the confirmation prompt. When using `ShouldContinue` in advanced functions, call it after the
`ShouldProcess` method returns `$true`.

You can get more details by running `Get-Help about_Functions_CmdletBindingAttribute` and
`Get-Help about_Functions_Advanced_Methods` command in PowerShell.

## How

Call the `ShouldContinue` method in advanced functions when `ShouldProcess` method returns `$true`.
To learn more, see [about_Functions_CmdletBindingAttribute][01] and
[about_Functions_Advanced_Methods][02].

## Example

### Wrong
### Noncompliant

```powershell
Function Test-ShouldContinue
Expand All @@ -39,7 +37,7 @@ Function Test-ShouldContinue
}
```

### Correct
### Compliant

```powershell
Function Test-ShouldContinue
Expand All @@ -57,3 +55,8 @@ Function Test-ShouldContinue
}
}
```

<!-- link references -->

[01]: /powershell/module/microsoft.powershell.core/about/about_functions_cmdletbindingattribute
[02]: /powershell/module/microsoft.powershell.core/about/about_functions_advanced_methods
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
---
description: Avoid trailing whitespace
ms.date: 06/28/2023
ms.date: 06/01/2026
ms.topic: reference
title: AvoidTrailingWhitespace
---
Expand All @@ -10,5 +10,46 @@ title: AvoidTrailingWhitespace

## Description

Lines should not end with whitespace characters. This can cause problems with the line-continuation
backtick, and also clutters up future commits to source control.
Lines shouldn't end with trailing whitespace characters. Trailing whitespace makes diffs harder to
review and can introduce subtle problems when line continuation uses a backtick (`), because the
backtick must be the last character on the line.

Keeping lines free of trailing whitespace improves readability and helps keep source control history
clean.

To learn more, see [about_Parsing][01].

## Example

### Noncompliant
Comment thread
Xelu86 marked this conversation as resolved.

```powershell
# The next line ends with a trailing space after the backtick.
Get-Process `
| Where-Object { $_.CPU -gt 100 }
```

When you run this script, PowerShell throws a parser error because the trailing space prevents line
continuation. For example:

```output
PS C:\WINDOWS\system32> Get-Process `
| Where-Object { $_.CPU -gt 100 }
At line:2 char:1
+ | Where-Object { $_.CPU -gt 100 }
+ ~
An empty pipe element is not allowed.
+ CategoryInfo : ParserError: (:) [], ParentContainsErrorRecordException
+ FullyQualifiedErrorId : EmptyPipeElement
```

### Compliant

```powershell
Get-Process `
| Where-Object { $_.CPU -gt 100 }
```

<!-- link references -->

[01]: /powershell/module/microsoft.powershell.core/about/about_parsing
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
---
description: Avoid sending credentials and secrets over unencrypted connections
ms.date: 02/28/2024
ms.date: 06/01/2026
ms.topic: reference
title: AvoidUsingAllowUnencryptedAuthentication
---
Expand All @@ -10,25 +10,22 @@ title: AvoidUsingAllowUnencryptedAuthentication

## Description

Avoid using the **AllowUnencryptedAuthentication** parameter of `Invoke-WebRequest` and
`Invoke-RestMethod`. When using this parameter, the cmdlets send credentials and secrets over
unencrypted connections. This should be avoided except for compatibility with legacy systems.
The **AllowUnencryptedAuthentication** parameter of `Invoke-WebRequest` and `Invoke-RestMethod`
permits credentials and secrets to be transmitted over unencrypted connections, creating a security
risk. Avoid using this parameter unless you must maintain compatibility with legacy systems that
require unencrypted authentication.

For more details, see [Invoke-RestMethod](xref:Microsoft.PowerShell.Utility.Invoke-RestMethod).
To learn more, see [Invoke-RestMethod](xref:Microsoft.PowerShell.Utility.Invoke-RestMethod).
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should also link to Invoke-WebRequest. Both links should be reference links, not inline links.


## How
## Example

Avoid using the **AllowUnencryptedAuthentication** parameter.

## Example 1

### Wrong
### Noncompliant

```powershell
Invoke-WebRequest foo -AllowUnencryptedAuthentication
```

### Correct
### Compliant

```powershell
Invoke-WebRequest foo
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
---
description: Avoid using broken hash algorithms
ms.date: 06/28/2023
ms.date: 06/01/2026
ms.topic: reference
title: AvoidUsingBrokenHashAlgorithms
---
Expand All @@ -10,37 +10,35 @@ title: AvoidUsingBrokenHashAlgorithms

## Description

Avoid using the broken algorithms MD5 or SHA-1.
Avoid using the cryptographically broken hash algorithms `MD5` and `SHA-1`. These algorithms are
vulnerable to collision attacks and are no longer considered secure for cryptographic purposes.

## How

Replace broken algorithms with secure alternatives. MD5 and SHA-1 should be replaced with SHA256,
SHA384, SHA512, or other safer algorithms when possible, with MD5 and SHA-1 only being utilized by
necessity for backwards compatibility.
Replace `MD5` and `SHA-1` with secure alternatives such as `SHA256`, `SHA384`, or `SHA512`. Use
broken algorithms only when absolutely necessary for backwards compatibility with legacy systems.

## Example 1
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure we need two examples for this rule. I think we can remove the second example and rename this heading to just Example.


### Wrong
### Noncompliant

```powershell
Get-FileHash foo.txt -Algorithm MD5
```

### Correct
### Compliant

```powershell
Get-FileHash foo.txt -Algorithm SHA256
```

## Example 2

### Wrong
### Noncompliant

```powershell
Get-FileHash foo.txt -Algorithm SHA1
```

### Correct
### Compliant

```powershell
Get-FileHash foo.txt
Expand Down
Loading