From 69806573371452f7232ef4635a9ccee0f3d9026f Mon Sep 17 00:00:00 2001
From: Shirofune-Security
 <43838376+Shirofune-Security@users.noreply.github.com>
Date: Mon, 21 Sep 2026 18:23:53 +0900
Subject: [PATCH] Reject unbound recovery options before command dispatch

---
 WELA.ps1                                    | 2 +-
 tests/FirewallLoggingRecovery.Cli.Tests.ps1 | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/WELA.ps1 b/WELA.ps1
index 3080e276..80e9072f 100644
--- a/WELA.ps1
+++ b/WELA.ps1
@@ -2013,7 +2013,7 @@ Write-Host "WELA v$WELAVersion - $WELAReleaseName"
 Write-Host ""
 
 if ($Cmd -ne 'firewall-recovery' -and @($PSBoundParameters.Keys | Where-Object { $_ -like 'FirewallRecovery*' }).Count) {throw 'FirewallRecovery options require firewall-recovery. No command was run.'}
-if ($Cmd -eq 'firewall-recovery' -and @($PSBoundParameters.Keys | Where-Object { $_ -notin @('Cmd','FirewallRecoveryAction','FirewallRecoveryProfile','FirewallRecoveryJournalPath','FirewallRecoveryResultsPath','FirewallRecoveryPlanPath','FirewallRecoveryPlanHash','FirewallRecoveryOutputPath','Auto','DryRun','Help') }).Count) {throw 'firewall-recovery accepts only dedicated options, Auto and DryRun. No command was run.'}
+if ($Cmd -eq 'firewall-recovery' -and ($args.Count -or @($PSBoundParameters.Keys | Where-Object { $_ -notin @('Cmd','FirewallRecoveryAction','FirewallRecoveryProfile','FirewallRecoveryJournalPath','FirewallRecoveryResultsPath','FirewallRecoveryPlanPath','FirewallRecoveryPlanHash','FirewallRecoveryOutputPath','Auto','DryRun','Help') }).Count)) {throw 'firewall-recovery accepts only dedicated options, Auto and DryRun. No command was run.'}
 if ($Cmd -ne 'channel-read' -and @($PSBoundParameters.Keys | Where-Object { $_ -like 'ChannelRead*' }).Count) { throw 'ChannelRead options require channel-read. No command was run.' }
 if ($Cmd -ne 'smb-runtime' -and @($PSBoundParameters.Keys | Where-Object { $_ -like 'SmbRuntime*' }).Count) {throw 'SmbRuntime options require smb-runtime. No command was run.'}
 if ($Cmd -eq 'smb-runtime' -and @($PSBoundParameters.Keys | Where-Object { $_ -notin @('Cmd','SmbRuntimeAction','SmbRuntimeOutputPath','Auto','DryRun','Help') }).Count) {throw 'smb-runtime accepts only its dedicated options, Auto and DryRun. No command was run.'}
diff --git a/tests/FirewallLoggingRecovery.Cli.Tests.ps1 b/tests/FirewallLoggingRecovery.Cli.Tests.ps1
index 09d4733b..2fb1346a 100644
--- a/tests/FirewallLoggingRecovery.Cli.Tests.ps1
+++ b/tests/FirewallLoggingRecovery.Cli.Tests.ps1
@@ -12,6 +12,7 @@ Check @('firewall-recovery','-RecoveryAction','Restore') 'dedicated|require audi
 Check @('firewall-recovery','-FirewallRecoveryProfile','All') 'ValidateSet|does not belong'
 Check @('firewall-recovery','-FirewallRecoveryAction','Plan','-Auto') 'requires one profile'
 Check @('firewall-recovery','-FirewallRecoveryAction','Restore','-DryRun') 'reviewed plan/hash'
+Check @('firewall-recovery','-FirewallRecoveryAction','Restore','-WhatIf') 'dedicated options'
 Check @('firewall-recovery','-FirewallRecoveryAction','Restore','-FirewallRecoveryPlanPath','missing','-FirewallRecoveryPlanHash',('a'*64),'-DryRun','-FirewallRecoveryOutputPath','must-not-exist') 'reviewed plan/hash'
 $global:LASTEXITCODE=0
 Write-Host "Firewall recovery public CLI: $n checks passed."