[PowerShell] Bare `break` in error-handling `catch` blocks escapes into the _caller's_ enclosing loop, silently aborting unrelated work

[tejeszacsko]

Scope: this report is about the PowerShell side of the repo (Redfish PowerShell/), checked against the current master branch. The pattern described is specific to PowerShell's break semantics and doesn't apply to the Python modules.

Summary

Several cmdlets use a bare break statement inside catch blocks to abort on error, with no enclosing loop in the function itself. In PowerShell, an unlabeled break with no enclosing loop at the current scope searches up the entire call stack for the nearest enclosing loop — including loops in whatever code called the cmdlet. If the caller happens to invoke the cmdlet from inside a loop (a very normal pattern — e.g. looping over several firmware components to update, or several disks to configure), that break silently terminates the caller's loop instead of just this cmdlet's own error handling, with no exception or error surfaced.

Minimal repro (pure PowerShell language behavior, no Dell hardware needed):

Function Inner {
    Try { Throw "simulated failure" }
    Catch { break }   # no enclosing loop in this function
}

Function Outer {
    ForEach ($i in 1..3) {
        Write-Host "iteration $i"
        Inner
        Write-Host "after Inner, iteration $i"   # never printed
    }
    Write-Host "loop finished"   # reached immediately after iteration 1
}

Outer

Output is only iteration 1, then straight to loop finished — iterations 2 and 3 never run, and "after Inner" never prints, even though Inner returned without throwing anything the caller could see.

Concrete impact observed

In Set-DeviceFirmwareSimpleUpdateREDFISH.psm1, the catch block around the firmware-upload Invoke-WebRequest call ends in a bare break. When that request fails — e.g. the iDRAC rejects the payload — this break propagated out of the module and out of our own wrapper function, silently terminating our caller's loop over several required firmware components. Our tool stopped checking the remaining firmware components entirely and reported overall success despite the update having failed, with no error or log line indicating anything had gone wrong.

Full scan of the current master branch

Parsed all 77 .psm1 files under Redfish PowerShell/ with System.Management.Automation.Language.Parser and checked every break statement's AST ancestry for a lexically-enclosing loop within its own function. Found 51 such "unsafe" break statements across 9 individual cmdlet files (not counting the same underlying functions duplicated again inside the large combined IdracRedfishSupport.psm1 convenience file):

File	Unsafe break count	Affected function(s)
Set-DeviceFirmwareSimpleUpdateREDFISH	10	download_image_payload, reboot_server, install_image_payload_query_job_status_reboot_server
Invoke-SupportAssistCollectionLocalREDFISH	10	get_support_assist_license_agreement, accept_support_assist_license_agreement, register_support_assist_feature, execute_support_assist_collection
Set-ScheduleRepositoryUpdateREDFISH	8	get_update_schedule_details, get_idrac_time, clear_update_schedule_details, set_scheduled_repository_update
Set-DeviceFirmwareRollbackREDFISH	6	get_firmware_versions, rollback_image_query_job_status_reboot_server
Set-DeviceFirmwareSimpleUpdateTransferProtocolREDFISH	6	get_firmware_versions, reboot_server, install_image_payload_query_job_status_reboot_server
Invoke-SystemEraseREDFISH	5	get_system_erase_components, execute_system_erase, power_on_server, finish_bios_reset_to_default
Invoke-ExportImportSslCertificateREDFISH	3	export_import_ssl_cert, delete_ssl_cert, restore_factory_defaults
Invoke-RemoteDiagsREDFISH	2	execute_remote_diags, export_remote_diags_results
Set-ExportImportServerConfigurationProfileNetworkShareREDFISH	1	Set-ExportImportServerConfigurationProfileNetworkShareREDFISH

The same functions are duplicated (with the same break statements) inside IdracRedfishSupport.psm1, which bundles many cmdlets into one combined file.

For context on false positives to rule out: several other files also use bare break (e.g. Get-IdracLifecycleLogsREDFISH, Set-NextOneTimeBootVirtualMediaDeviceOemREDFISH), but in those cases the break sits inside an actual while/for loop within the same function, so it's correctly scoped and not a problem — only the ones listed above lack any enclosing loop of their own.

Suggested fix

Where a catch block is meant to abort the current function on error (which appears to be the intent in all cases found), replace the bare break with return (or return $false/an appropriate error/status value). return exits only the current function and cannot escape into a caller's loop, avoiding this class of bug entirely while preserving the "stop processing now" intent.

Environment

• Windows PowerShell 5.1
• Modules loaded via Import-Module from a calling script that iterates over multiple items (e.g. multiple firmware components) in a loop

[texroemer]

Hi @tejeszacsko

Changes have been made to the cmdlets with the issue and pushed. I also noticed a new other bugs related to the cmdlets working on both iDRAC9 and 10 which i fixed.

Thanks
Tex

[tejeszacsko]

Thanks so much for turning this around, Tex — really appreciate you digging into it. Re-checked it against the current master branch (a freshly pulled zip snapshot) using the same method as the original report — parsed every .psm1 under Redfish PowerShell/ with System.Management.Automation.Language.Parser and walked each break statement's AST ancestry for a lexically-enclosing loop or switch within its own function.

Good news: real progress. Total unsafe breaks across the 9 originally-flagged files dropped from 51 to 14, and 6 of the 9 files are now completely clean:

File	Original count	Current master	Status
Set-DeviceFirmwareSimpleUpdateREDFISH	10	7	⚠️ Partially fixed
Invoke-SupportAssistCollectionLocalREDFISH	10	4	⚠️ Partially fixed
Set-ScheduleRepositoryUpdateREDFISH	8	0	✅ Fixed
Set-DeviceFirmwareRollbackREDFISH	6	0	✅ Fixed
Set-DeviceFirmwareSimpleUpdateTransferProtocolREDFISH	6	0	✅ Fixed
Invoke-SystemEraseREDFISH	5	0	✅ Fixed
Invoke-ExportImportSslCertificateREDFISH	3	3	❌ Unchanged
Invoke-RemoteDiagsREDFISH	2	0	✅ Fixed
Set-ExportImportServerConfigurationProfileNetworkShareREDFISH	1	0	✅ Fixed
Total	51	14

Also good: none of the previously-clean files picked up any new unsafe breaks, so whatever changed didn't spread this pattern anywhere new.

A few spots that could still use a look

Set-DeviceFirmwareSimpleUpdateREDFISH.psm1 — the function from our original repro (download_image_payload) is fixed. The other two functions we listed still have the same shape:

Function	Unsafe break lines
reboot_server	573, 646, 841, 910
install_image_payload_query_job_status_reboot_server	984, 1127, 1133

Example (line 570-574, same shape as the original report):

else
{
    [String]::Format("- FAIL, statuscode {0} returned",$result1.StatusCode)
    break
}

This one matters a bit for us specifically: reboot_server and install_image_payload_query_job_status_reboot_server are both on the normal firmware-update path (upload → reboot → poll/install → reboot), so a caller looping over several firmware components — the exact scenario in our original repro — could still have that loop cut short by a break from this module.

Invoke-SupportAssistCollectionLocalREDFISH.psm1 — execute_support_assist_collection is clean now, and the other three are partway there:

Function	Unsafe break lines
get_support_assist_license_agreement	250
accept_support_assist_license_agreement	309
register_support_assist_feature	348, 456

Invoke-ExportImportSslCertificateREDFISH.psm1 — doesn't look like this one's been gotten to yet; all three originally-named functions still have one unsafe break each, in the same shape:

Function	Unsafe break line
export_import_ssl_cert	265
delete_ssl_cert	357
restore_factory_defaults	424

One more thing worth knowing: IdracRedfishSupport.psm1 (the combined file) carries the same gaps

As noted in the original thread, this file bundles many cmdlets together. The duplicated copies of the still-open functions above carry the same unsafe breaks:

Function (duplicated in IdracRedfishSupport.psm1)	Unsafe break lines
get_support_assist_license_agreement	33015
accept_support_assist_license_agreement	33074
register_support_assist_feature	33113, 33221
reboot_server	35012, 35085, 35280, 35349
install_image_payload_query_job_status_reboot_server	35423, 35566, 35572

Just flagging so the combined file doesn't get missed if/when the remaining fixes land in the individual modules — might need a separate re-sync afterward.

Unrelated to this issue, but since we scanned the whole tree anyway

Invoke-CreateXauthTokenSessionREDFISH.psm1 doesn't parse on current master (ParseFile reports "Unexpected token ' ' in expression or statement" at line 304) — Import-Module would fail on this file as it stands. It's 3,545,132 bytes (confirmed via the GitHub contents API, so not something that got mangled in our own download) versus 18,871 bytes for the same file's previous revision we have vendored — the difference is a contiguous run of roughly 1.75 million NUL (0x00) characters embedded partway through, which trips up the parser inside a catch block ($RespErr gets split across it).

This one's unrelated to the current round of fixes — the file's commit history shows it hasn't been touched since e9bfe70 ("Update to handle basic auth change in iDRAC10", 2026-04-21), so it's been like this for a few months already, independent of everything else here. No rush, just worth a re-save whenever it's convenient.

Net effect for us: we'll keep our own break-shield workaround around firmware updates for now, since the two functions our tool calls into (reboot_server, install_image_payload_query_job_status_reboot_server) aren't covered by the fix yet. Really appreciate the work on this so far, and happy to re-verify again whenever there's a follow-up.