PowerShell Extension v2020.3.0 breaks with AppLocker

[johlju]

We are allowing scripts and executables in the extension folder to be run in %OSDRIVE%\USERS\%USER%\.VSCODE\EXTENSIONS. The below error happens with the new version, but this does work with the previous version. As a workaround we have reverted back to the previous version for now.

Exception encountered starting EditorServices. Exception logged in D:\a\1\s\src\PowerShellEditorServices.Hosting\Commands\StartEditorServicesCommand.cs on line 247 in EndProcessing:
System.Management.Automation.CmdletInvocationException: Cannot dot-source this command because it was defined in a different language mode. To invoke this command without importing its contents, omit the '.' operator. ---> System.NotSupportedException: Cannot dot-source this command because it was defined in a different language mode. To invoke this command without importing its contents, omit the '.' operator.
   --- Slut på stackspårning för interna undantag ---
   vid System.Management.Automation.Runspaces.PipelineBase.Invoke(IEnumerable input)
   vid System.Management.Automation.PowerShell.Worker.ConstructPipelineAndDoWork(Runspace rs, Boolean performSyncInvoke)
   vid System.Management.Automation.PowerShell.CoreInvokeHelper[TInput,TOutput](PSDataCollection`1 input, PSDataCollection`1 output, PSInvocationSettings settings)
   vid System.Management.Automation.PowerShell.CoreInvoke[TInput,TOutput](PSDataCollection`1 input, PSDataCollection`1 output, PSInvocationSettings settings)
   vid System.Management.Automation.PowerShell.Invoke(IEnumerable input, PSInvocationSettings settings)
   vid Microsoft.PowerShell.EditorServices.Hosting.EditorServicesLoader.LogPowerShellDetails()
   vid Microsoft.PowerShell.EditorServices.Hosting.EditorServicesLoader.LogHostInformation()
   vid Microsoft.PowerShell.EditorServices.Hosting.EditorServicesLoader.LoadAndRunEditorServicesAsync()
   vid Microsoft.PowerShell.EditorServices.Commands.StartEditorServicesCommand.EndProcessing()

2020-03-06 10:31:05 [NORMAL] - Visual Studio Code v1.42.1 64-bit
2020-03-06 10:31:05 [NORMAL] - PowerShell Extension v2020.3.0
2020-03-06 10:31:05 [NORMAL] - Operating System: Windows 64-bit
2020-03-06 10:31:05 [NORMAL] - Language server starting --
2020-03-06 10:31:05 [NORMAL] -     PowerShell executable: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe
2020-03-06 10:31:05 [NORMAL] -     PowerShell args: -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command Import-Module 'c:\Users\johlju\.vscode\extensions\ms-vscode.powershell-2020.3.0\modules\PowerShellEditorServices\PowerShellEditorServices.psd1'; Start-EditorServices -HostName 'Visual Studio Code Host' -HostProfileId 'Microsoft.VSCode' -HostVersion '2020.3.0' -AdditionalModules @('PowerShellEditorServices.VSCode') -BundledModulesPath 'c:\Users\johlju\.vscode\extensions\ms-vscode.powershell-2020.3.0\modules' -EnableConsoleRepl -LogLevel 'Normal' -LogPath 'c:\Users\johlju\.vscode\extensions\ms-vscode.powershell-2020.3.0\logs\1583487065-bd4cd06b-756f-42c5-b413-6b485a2b237b1583487062238\EditorServices.log' -SessionDetailsPath 'c:\Users\johlju\.vscode\extensions\ms-vscode.powershell-2020.3.0\sessions\PSES-VSCode-13336-569282' -FeatureFlags @() 
2020-03-06 10:31:05 [NORMAL] -     PowerShell Editor Services args: Import-Module 'c:\Users\johlju\.vscode\extensions\ms-vscode.powershell-2020.3.0\modules\PowerShellEditorServices\PowerShellEditorServices.psd1'; Start-EditorServices -HostName 'Visual Studio Code Host' -HostProfileId 'Microsoft.VSCode' -HostVersion '2020.3.0' -AdditionalModules @('PowerShellEditorServices.VSCode') -BundledModulesPath 'c:\Users\johlju\.vscode\extensions\ms-vscode.powershell-2020.3.0\modules' -EnableConsoleRepl -LogLevel 'Normal' -LogPath 'c:\Users\johlju\.vscode\extensions\ms-vscode.powershell-2020.3.0\logs\1583487065-bd4cd06b-756f-42c5-b413-6b485a2b237b1583487062238\EditorServices.log' -SessionDetailsPath 'c:\Users\johlju\.vscode\extensions\ms-vscode.powershell-2020.3.0\sessions\PSES-VSCode-13336-569282' -FeatureFlags @() 
2020-03-06 10:31:05 [NORMAL] - powershell.exe started.
2020-03-06 10:31:05 [NORMAL] - Waiting for session file
2020-03-06 10:33:05 [NORMAL] - Error occurred retrieving session file
2020-03-06 10:33:05 [NORMAL] - Language server startup failed.
2020-03-06 10:33:05 [ERROR] - The language service could not be started: 
2020-03-06 10:33:05 [ERROR] - Timed out waiting for session file to appear.

If you need more debug information let us know.

[rjmholt]

The PowerShell extension doesn't yet support constrained language mode. There's a fair amount more work to be done to make it possible.

Duplicate of #754.

[johlju]

Just to be clear, the prior version did work and have worked in our corporate environment. This just broke in the latest release. But understand that this is part in a larger issue as you mentioned.

[rjmholt]

the prior version did work

Ah, sorry to hear that. That's certainly unexpected that it worked.

[johlju]

We made exceptions for a very limited number of dev workstations for PowerShell development. On those we are allowing scripts and executables in the extension folder to be run in %OSDRIVE%\USERS\%USER%\.VSCODE\EXTENSIONS, but those exceptions seems not to be enough any longer since we get the "dot-sourced" error.

[rjmholt]

since we get the "dot-sourced" erro

The error comes from a C# invocation like this:

PowerShell.Create().AddScript("$PSVersionTable").Invoke()

I imagine the dot sourcing is implicit, but in some cases I think we need the execution results to happen in the invoking context. We currently use similar invocations throughout the codebase.

@daxian-dbw @PaulHigin is there any way to allow running inline scripts from C# in constrained language mode? Like being able to specify the language mode of the script being invoked?

[PaulHigin]

I don't believe anything has changed with PowerShell running under AppLocker. It should continue to run in FullLanguage mode for approved directory locations. Is it possible that the AppLocker policy changed? @TravisEz13 is more familiar with AppLocker than I, and may be able to help.

[rjmholt]

I don't believe anything has changed with PowerShell running under AppLocker

Well this is for Windows PowerShell, so I suspect it's our usage that's changed.

The question is though, is it possible to invoke PowerShell from C# in a trusted way? This is inline PowerShell script, so it doesn't live anywhere on the file system.

[PaulHigin]

No, we currently don't support signed script blocks, so any inline script is considered untrusted and will run in ConstrainedLanguage mode if AppLocker is enforcing system lock down.

[AndyH16]

We're experiencing this same error (with Applocker enabled on our network). Downgrading to 2010.1.0 and disabling extension updates works for now. It does still come up with the warning regarding dot-sourcing/language mode but doesn't cause the Terminal window to crash/close, like 2020.3.0 does.

[jotrueck]

Looks like i am also affected by this Problem. Applocker is essential for our Client and Server security concept. So we need to solve this in a secure way.

[mverbaas]

I have the same/simular issue:
Exception encountered starting EditorServices. Exception logged in D:\a\1\s\src\PowerShellEditorServices.Hosting\Commands\StartEditorServicesCommand.cs on line 247 in EndProcessing:
System.Management.Automation.CmdletInvocationException: Cannot dot-source this command because it was defined in a different language mode. To invoke this command without importing its contents, omit the '.' operator. ---> System.NotSupportedException: Cannot dot-source this command because it was defined in a different language mode. To invoke this command without importing its contents, omit the '.' operator.
--- End of inner exception stack trace ---
at System.Management.Automation.Runspaces.PipelineBase.Invoke(IEnumerable input)
at System.Management.Automation.PowerShell.Worker.ConstructPipelineAndDoWork(Runspace rs, Boolean performSyncInvoke)
at System.Management.Automation.PowerShell.CoreInvokeHelper[TInput,TOutput](PSDataCollection1 input, PSDataCollection1 output, PSInvocationSettings settings)
at System.Management.Automation.PowerShell.CoreInvoke[TInput,TOutput](PSDataCollection1 input, PSDataCollection1 output, PSInvocationSettings settings)
at System.Management.Automation.PowerShell.Invoke(IEnumerable input, PSInvocationSettings settings)
at Microsoft.PowerShell.EditorServices.Hosting.EditorServicesLoader.LogPowerShellDetails()
at Microsoft.PowerShell.EditorServices.Hosting.EditorServicesLoader.LogHostInformation()
at Microsoft.PowerShell.EditorServices.Hosting.EditorServicesLoader.LoadAndRunEditorServicesAsync()
at Microsoft.PowerShell.EditorServices.Commands.StartEditorServicesCommand.EndProcessing()