在 NuGet 包安装/初始化期间运行的 Powershell 脚本有哪些安全限制？
从 NuGet 安装包时，它可以运行一些 Powershell 脚本来进行设置（例如导出要在包管理器控制台中使用的命令）。
我正在尝试（但失败）找到这些脚本可以/不能做什么的详细信息。具体来说 - 我们应该担心其中的恶意代码吗？他们可以读取文件系统、发送网络请求等吗？
When you install a package from NuGet, it can run some Powershell scripts to set things up (such as exporting commands to be used in the Package Manager console).
I'm trying (and failing) to find details of what these scripts can/can't do. Specifically - should we be worried about malicious code in these? Can they read the filesystem, send web requests, etc.?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
我会听从 NuGet 团队的某个人的意见，但我几乎可以肯定他们是在当前的执行策略下运行的。
这是我自己的 nuget 控制台的一个片段：
如果我以管理员身份打开 PowerShell 并更改执行策略，nuget 会报告更改：
总之，您在默认主机上拥有的任何执行策略也适用于 nuget 控制台。
I'll defer to someone from the NuGet team, but I'm almost certain they run under the current execution policy.
Here's a clip from my own nuget console:
If I open PowerShell as an admin and change the execution policy, nuget reports the change:
In sum, whatever execution policy you've got on your default host also applies to the nuget console.
当您从 Internet 下载脚本时，除非使用安装程序安装该脚本并为其授予了升级的安装权限，否则这些脚本将被标记为被阻止。您必须通过右键单击脚本并选择“取消阻止”按钮来授权（取消阻止）它们。
When you download a script from the internet, unless it is installed with a setup program where you have given it escalated permissions to install, the scripts are marked as blocked. You have to authorize (unblock) them by right clicking on the scripts and choosing the button Unblock.
当 NuGet 设置 PowerShell 主机时，它会检查当前的 ExecutionPolicy 是什么。如果它不是 Unrestricted、RemoteSigned 或 Bypass，则会强制当前进程 (devenv.exe) 的 ExcecutionPolicy 为 RemoteSigned。
PowerShell 不会看到从 Internet 下载的嵌入脚本 init.ps1、install.ps1 等，因此无法阻止恶意脚本在您的计算机上执行您的帐户有权执行的任何操作。
此时，所有 NuGet 包创建者几乎都处于“荣誉”系统上。我相信Ruby Gems也有类似的情况。
NuGet 确实能够使用私有包源，因此如果安全性至关重要，我建议您下载并审查所有包，并且只允许安装来自这些受信任源的包。
When NuGet sets up the PowerShell host, it checks to see what the current ExecutionPolicy is. If it is not Unrestricted, RemoteSigned, or Bypass, it forces the ExcecutionPolicy to RemoteSigned for the current process (devenv.exe).
PowerShell does not see the embedded scripts init.ps1, install.ps1, etc. as being downloaded from the Internet, so there is nothing preventing a malicious script from doing anything on your machine that your account has permissions to do.
At this point, all NuGet package creators are pretty much on the "honor" system. I believe Ruby Gems have a similar situtation.
NuGet does have the ability to use private package sources, so if security is critical, I suggest you download and vet all packages, and only allow installing packages from these trusted sources.