Add an extra check for CredentialAttribute for the credential rules

[quoctruong]

No description provided.

[raghushantha]

Looks good. pls merge

[KirkMunro]

Before you merge, can you replace your "or" with "and", and fix the logic accordingly?

"Checks that Credential parameters are of type PSCredential and have the Credential attribute"

(make sure that they are used in the proper order as well).

The proper best practice is to use both the type and the attribute. See my comments in the discussion on the post that got you started with these changes in the first place for more information.

[quoctruong]

Thanks Kirk for the suggestion. Fixed and merged.

[KirkMunro]

I just skimmed over the code, and PSCredentialTypeNoViolations.ps1 has a bug. The parameter syntax is currently listed as:

# Param1 help description
[Parameter(Mandatory=$true,
           ValueFromPipelineByPropertyName=$true,
           Position=0)]
[System.Management.Automation.CredentialAttribute()]
[pscredential]
$Credential

This syntax is incorrect, and it highlights exactly why the order is important. You should use this syntax as a test of incorrect behaviour and check ordering of the Credential Attribute and the PSCredential type. The correct syntax is as follows:

# Param1 help description
[Parameter(Mandatory=$true,
           ValueFromPipelineByPropertyName=$true,
           Position=0)]
[pscredential]
[System.Management.Automation.CredentialAttribute()]
$Credential

PowerShell evaluates attributes for parameters from the bottom up. With the PSCredential type first, as in the first, wrong example, if you attempt to pass a string value into the Credential parameter, PowerShell will try to convert that string into a PSCredential. The conversion will fail, and the function will return an error. In the second, correct example, PowerShell will pass a string it receives through the CredentialAttribute, which will prompt the user with a dialog window for the password to go with the username (string) they provided. Once the password has been provided and the dialog closed with the OK button, the PSCredential object will be compared against the PSCredential type to see if the types match, and since they will match, the parameter will be accepted.

All to say, the PSCredential type must be listed above or to the left of the Credential attribute. That is the only way to properly define a credential parameter in PowerShell.

[quoctruong]

Thanks for the suggestion Kirk. I've made a new pull request to enforce this: #394

[KirkMunro]

Just had a look, and it looks better now. Thanks Quoc!