fix(checkver)!: Harden checkver script evaluation

Signed-off-by: Chawye Hsu <su+git@chawyehsu.com>

Author: chawyehsu

CHANGELOG.md

@@ -36,6 +36,7 @@
 - **core:** Give `dark` higher priority when use `Extract-DarkArchive` ([#6637](https://github.com/ScoopInstaller/Scoop/issues/6637))
 - **checkver:** Harden github checkver ([#6641](https://github.com/ScoopInstaller/Scoop/issues/6641))
 - **scoop-search:** Select latest search result semantically ([#6643](https://github.com/ScoopInstaller/Scoop/issues/6643))
+- **checkver:** Harden checkver script evaluation ([#6652](https://github.com/ScoopInstaller/Scoop/issues/6652))
 
 ### Code Refactoring
 

bin/checkver.ps1

@@ -266,6 +266,46 @@ function next($er) {
     Write-Host $er -ForegroundColor DarkRed
 }
 
+function Invoke-SanitizeScriptBlock {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string] $ScriptBlock
+    )
+
+    $tokens = $null
+    $errors = $null
+    $ast = [System.Management.Automation.Language.Parser]::ParseInput($ScriptBlock, [ref]$tokens, [ref]$errors)
+
+    if ($errors.Count -gt 0 -or -not $ast) {
+        $message = if ($errors) { $errors[0].Message } else { 'unknown parse error' }
+        return $true, $message
+    }
+
+    # Restrict the capability of accessing outer variables via `$using:`
+    if ($ast.Find({ param($node) $node -is [System.Management.Automation.Language.UsingExpressionAst] }, $true)) {
+        return $true, "'`$using:' may not be used"
+    }
+
+    return $false, $null
+}
+
+function Get-CheckverScriptPrelude() {
+    return @(
+        '$ErrorActionPreference = "Stop"',
+        '$ProgressPreference = "SilentlyContinue"',
+        # Set allowed env vars, `SystemRoot` is required for irm/iwr
+        '$allowedEnvs = @("SystemRoot","TEMP","TMP")',
+        'Get-ChildItem Env: | Where-Object { $allowedEnvs -notcontains $_.Name } | Remove-Item',
+        # Use `UseBasicParsing` for Invoke-WebRequest by default (WindowsPowerShell)
+        '$PSDefaultParameterValues["Invoke-WebRequest:UseBasicParsing"] = $true',
+        # Use ConstrainedLanguage language mode to restrict checkver.script capabilities
+        '$ExecutionContext.SessionState.LanguageMode = "ConstrainedLanguage"',
+        # Available variables/functions for checkver.script
+        # - `$page`: the retrieved webpage content
+        '$page = $using:page'
+    )
+}
+
 # wait for all to complete
 while ($in_progress -gt 0) {
     $ev = Wait-Event
@@ -318,12 +358,26 @@ while ($in_progress -gt 0) {
             $page = (New-Object System.IO.StreamReader($ms, (Get-Encoding $wc))).ReadToEnd()
         }
 
+        # checkver.script evaluation
         if ($script) {
-            $page = Invoke-Command ([scriptblock]::Create($script -join "`r`n"))
-            $source = 'the output of script'
+            $script = @($script) -join "`n"
+            $isBadScript, $errorMessage = Invoke-SanitizeScriptBlock $script
+            if ($isBadScript) {
+                next "invalid checkver.script: $errorMessage"
+                continue
+            }
+
+            $prelude = Get-CheckverScriptPrelude
+
+            $script = $prelude + $script
+            $scriptBlock = [scriptblock]::Create($script -join "`n")
+
+            $page = (Start-Job -ScriptBlock $scriptBlock | Receive-Job -Wait -AutoRemoveJob | Out-String).Trim()
+            Write-Verbose "Output from evaluating checkver.script:`r`n$page"
+            $source = 'the output of checkver.script'
         }
 
-        if ($null -eq $page) {
+        if (!$page) {
             next "couldn't retrieve content from $source"
             continue
         }