Skip to main content

Documentation Index

Fetch the complete documentation index at: https://tally.wharflab.com/llms.txt

Use this file to discover all available pages before exploring further.

powershell/PSAvoidUsingInvokeExpression is a PSScriptAnalyzer diagnostic emitted by tally for PowerShell snippets embedded in Dockerfiles.
PropertyValue
SeverityWarning
CategoryPSScriptAnalyzer
Auto-fixNo

​
Description

Care must be taken when using the Invoke-Expression command. The Invoke-Expression executes the specified string and returns the results. Code injection into your application or script can occur if the expression passed as a string includes any data provided from the user.

​
How

Remove the use of Invoke-Expression.

​
Examples

​
Problematic code

Invoke-Expression 'Get-Process'

​
Correct code

Get-Process

​
Source

This rule documentation is adapted from Microsoft’s PSScriptAnalyzer documentation for AvoidUsingInvokeExpression, licensed under CC BY 4.0.