fix(checkver)!: Harden checkver script evaluation

Signed-off-by: Chawye Hsu <su+git@chawyehsu.com>

Author: chawyehsu

bin/checkver.ps1

@@ -266,6 +266,23 @@ function next($er) {
     Write-Host $er -ForegroundColor DarkRed
 }
 
+function Get-CheckverScriptPrelude() {
+    return @(
+        '$ErrorActionPreference = "Stop"',
+        '$ProgressPreference = "SilentlyContinue"',
+        # Set allowed env vars, `SystemRoot` is required for irm/iwr
+        '$allowedEnvs = @("SystemRoot","TEMP","TMP")',
+        'Get-ChildItem Env: | Where-Object { $allowedEnvs -notcontains $_.Name } | Remove-Item',
+        # Use `UseBasicParsing` for Invoke-WebRequest by default (WindowsPowerShell)
+        '$PSDefaultParameterValues["Invoke-WebRequest:UseBasicParsing"] = $true',
+        # Use ConstrainedLanguage language mode to restrict checkver.script capabilities
+        '$ExecutionContext.SessionState.LanguageMode = "ConstrainedLanguage"',
+        # Available variables/functions for checkver.script
+        # - `$page`: the retrieved webpage content
+        '$page = $using:page'
+    )
+}
+
 # wait for all to complete
 while ($in_progress -gt 0) {
     $ev = Wait-Event
@@ -318,12 +335,22 @@ while ($in_progress -gt 0) {
             $page = (New-Object System.IO.StreamReader($ms, (Get-Encoding $wc))).ReadToEnd()
         }
 
+        # checkver.script evaluation
         if ($script) {
-            $page = Invoke-Command ([scriptblock]::Create($script -join "`r`n"))
-            $source = 'the output of script'
+            # Restrict the capabilities of accessing outer variables via `$using:`
+            # by replacing possible `$using:` uses with `$` before evaluation
+            $script = $script -replace '\$using:','$'
+            $prelude = Get-CheckverScriptPrelude
+
+            $script = $prelude + @($script)
+            $scriptBlock = [scriptblock]::Create($script -join "`n")
+
+            $page = (Start-Job -ScriptBlock $scriptBlock | Receive-Job -Wait -AutoRemoveJob | Out-String).Trim()
+            Write-Verbose "Output from evaluating checkver.script:`r`n$page"
+            $source = 'the output of checkver.script'
         }
 
-        if ($null -eq $page) {
+        if (!$page) {
             next "couldn't retrieve content from $source"
             continue
         }