build(analyzers): vendor InjectionHunter for PowerShell injection SAST

[NWarila]

What

Vendor Microsoft/Lee Holmes' InjectionHunter ruleset (PowerShell Gallery v1.0.0, frozen since 2017) under analyzers/InjectionHunter/ and wire it into the house PSScriptAnalyzer config via CustomRulePath. It taint-tracks untrusted input into execution contexts (Invoke-Expression, Add-Type, dynamic member/method/property access, cmd/powershell command injection, unsafe escaping) — a defect class the built-in rules (e.g. PSAvoidUsingInvokeExpression) do not catch.

How

• Pinned, not installed live. InjectionHunter.psd1 + .psm1 are committed byte-identical to the Gallery package (SHA-256 in VENDORED.md), marked -text in .gitattributes so EOL normalization cannot alter the bytes (the .psm1 is CRLF + signed; the .psd1 is UTF-16), and allowlisted in the deny-all .gitignore. Only the manifest + module are vendored (not the .cat/upstream tests).
• Audited before vendoring (VENDORED.md): eight passive AST rule functions; no install logic, no network, no filesystem writes, no obfuscation.
• Wired via CustomRulePath += './analyzers/InjectionHunter/InjectionHunter.psd1'; IncludeDefaultRules/IncludeRules/ExcludeRules/Rules unchanged (IH rules are additive).
• CI analyze excludes the vendored directory from its own lint target set (third-party upstream, not restyled to house rules) while still loading it as a rule provider.
• Self-test tests/InjectionHunter.Tests.ps1 proves the ruleset is loaded through the settings file and fires on Invoke-Expression and Add-Type fixtures while staying clean on safe idiom.

⚠️ Two things for the auditor

1. License. InjectionHunter ships no open-source license. The Gallery declares no LicenseUri (manifest copyright: "(c) Microsoft Corporation 2016. All rights reserved."); the canonical github.com/PowerShell/InjectionHunter repo is gone (404) and the only fork is unlicensed. I did not fabricate an MIT LICENSE; VENDORED.md records the real status and preserves Microsoft's attribution. Whether to vendor (vs. restore at build time) is an owner call.

2. 3 false positives fixed in HouseRules.psm1. Wiring IH surfaced three InjectionRisk.UnsafeEscaping findings in analyzers/HouseRules.psm1, all benign empty-string -replace operands (stripping scope/namespace prefixes from AST type names — no untrusted input, no execution). I resolved them by writing the empty replacement as [System.String]::Empty (behavior-identical, house-idiomatic, no logic change), which keeps the rule fully active everywhere rather than blanket-excluding it. The scaffold src/ sources were already clean.

Verify

Invoke-ScriptAnalyzer (CI command, vendored dir excluded) → 0 findings on own sources. Pester suite 37/37, coverage 93.62% / 80%. The 3 self-tests pass (fires on injection, clean on safe idiom). actionlint runs in CI.

Next step: IH-2 — mirror this byte-identical into windows-certificate-store-exporter (and any other template consumers), ensuring its src/** is 0-findings. Template merge-authority needs owner confirmation.

Do not merge — pending audit.

[NWarila]

Closing unmerged — decision to not adopt InjectionHunter. The implementation here is clean and was fully audited (vendored .psm1/.psd1 verified byte-identical to PowerShell Gallery v1.0.0; passive AST ruleset with no hidden behavior; CustomRulePath wiring correct; analyze 0 findings; Pester 37/0 at 93.62%; signed Conventional Commit; all CI green). The drop is strategic, not a quality issue:

• No OSS license: InjectionHunter ships no license grant (Gallery declares no LicenseUri; '(c) Microsoft Corporation 2016. All rights reserved.'; the source repo is gone). Vendoring would redistribute unlicensed code; restore-at-build would add permanent fetch+verify plumbing to the shared build for every consumer.
• Marginal value: the primary vector (Invoke-Expression) is already gated by the built-in PSAvoidUsingInvokeExpression; the incremental rules only apply to dynamic-execution patterns these repos do not contain.
• Lean: not worth a frozen, unlicensed dependency for a near-nil injection surface.

May be revisited per-repo if a future repo gains real dynamic-execution surface.