UseFullyQualifiedCommandNames: Implement a rule to flag command uses that could be ambiguous based on state

[TravisEz13]

Without fully qualified command invocation there are various ways to plant another command. We should advise PowerShell users to use the correct pattern.

ways to plant:

• aliases
• native command in path
• loading another module with a command with the same name

[rjmholt]

@TravisEz13 we could use a more in-depth description of what would need to be implemented here, or a pointer to existing advice on this

[TravisEz13]

Instead of calling Invoke-WebRequest
You should call Microsoft.PowerShell.Utility\Invoke-WebRequest

I'm not sure where this is documented. I'll forward you the internal thread.

[bergmeister]

In order to differentiate a cmdlet from a native command in the parser, we'd have to run a Get-Command against it, which is expensive but is already practiced in other areas. It just means the rule should definitely not be on by default and that it will be a bit sluggish. The PowerShell language seems to have a using module <module-name> syntax, would that not be a good alternative, instead of making the commands so much longer?
Out of interest: Does it have measurable performance benefits to fully qualify?

[rjmholt]

Does it have measurable performance benefits to fully qualify?

Probably when:

• The command is going to fail
• There qualified module isn't available

we'd have to run a Get-Command against it

Well that's only if it's going to run in the current context. I suspect there are plenty of scenarios where that won't be the case. I think the possibilities are:

• Make a syntax-based determination
• Simply require all commands to have a slash in them

[TravisEz13]

I was thinking this would go into a set of security rules that might be more advanced. Another example, would be avoid using Invoke-Expression. Almost every use of it that I've found can be avoided, and leads to injection vulnerabilities.

Another example would be having an export-modulemember statement in a psm1 that doesn't use a wildcard (technically you can have this in the psd1 or psm1, but I'm just trying to give examples)