build(analyzers): vendor InjectionHunter for PowerShell injection SAST

.gitattributes

@@ -13,6 +13,11 @@
 
 LICENSE   text eol=lf
 
+# Vendored InjectionHunter ruleset: store byte-identical to the PowerShell Gallery
+# package (UTF-16 manifest; CRLF + signed module). No EOL normalization.
+analyzers/InjectionHunter/InjectionHunter.psd1  -text
+analyzers/InjectionHunter/InjectionHunter.psm1  -text
+
 .github/        export-ignore
 .gitignore      export-ignore
 .gitattributes  export-ignore

.github/workflows/ci.yaml

@@ -58,7 +58,14 @@ jobs:
       - name: Run PSScriptAnalyzer
         shell: pwsh
         run: |
-          $results = Invoke-ScriptAnalyzer -Path . -Settings ./PSScriptAnalyzerSettings.psd1 -Recurse
+          # Lint this repo's own sources. The vendored, pinned InjectionHunter ruleset under
+          # analyzers/InjectionHunter/ is third-party upstream code loaded via CustomRulePath
+          # (not ours to restyle to house rules), so it is excluded from the lint target set.
+          $targets = Get-ChildItem -Path . -Recurse -File -Include '*.ps1', '*.psm1', '*.psd1' |
+            Where-Object { ($_.FullName -replace '\\', '/') -notlike '*/analyzers/InjectionHunter/*' }
+          $results = $targets | ForEach-Object {
+            Invoke-ScriptAnalyzer -Path $_.FullName -Settings ./PSScriptAnalyzerSettings.psd1
+          }
           if ($results) {
             $results | Format-Table -AutoSize | Out-String | Write-Host
             $errors = @($results | Where-Object { $_.Severity -eq 'Error' })

.gitignore

@@ -22,6 +22,12 @@
 !/analyzers/
 !/analyzers/*.psm1
 
+# Vendored InjectionHunter ruleset (frozen, pinned; see analyzers/InjectionHunter/VENDORED.md)
+!/analyzers/InjectionHunter/
+!/analyzers/InjectionHunter/*.psd1
+!/analyzers/InjectionHunter/*.psm1
+!/analyzers/InjectionHunter/*.md
+
 # Module source
 !/src/
 !/src/**/

PSScriptAnalyzerSettings.psd1

@@ -11,6 +11,7 @@
 
   CustomRulePath      = @(
     './analyzers/HouseRules.psm1'
+    './analyzers/InjectionHunter/InjectionHunter.psd1'
   )
 
   IncludeDefaultRules = $true

analyzers/HouseRules.psm1

@@ -167,7 +167,7 @@ Function Get-HouseRuleVariableName {
     $VariableAst.VariablePath.IsScript -eq $False -and
     $VariableAst.VariablePath.IsGlobal -eq $False
   ) {
-    [System.String]($VariableAst.VariablePath.UserPath -replace '(?i)^(private|local):', '')
+    [System.String]($VariableAst.VariablePath.UserPath -replace '(?i)^(private|local):', [System.String]::Empty)
   }
 
 }
@@ -926,9 +926,9 @@ Function Get-HouseRuleFunctionAttribute {
           (
             ([System.String]$PSItem.TypeName.FullName) -replace
             '^(System\.Management\.Automation\.)?',
-            ''
+            [System.String]::Empty
           ) -replace 'Attribute$',
-          ''
+          [System.String]::Empty
         ) -ieq $AttributeName
       }
   }
@@ -961,9 +961,9 @@ Function Get-HouseRuleAttributeName {
     (
       ([System.String]$AttributeAst.TypeName.FullName) -replace
       '^(System\.Management\.Automation\.)?',
-      ''
+      [System.String]::Empty
     ) -replace 'Attribute$',
-    ''
+    [System.String]::Empty
   )
 
 }