From dc1e354475592bf6f08f4f85d5ede0e3885415b6 Mon Sep 17 00:00:00 2001
From: Shirofune-Security
 <43838376+Shirofune-Security@users.noreply.github.com>
Date: Mon, 21 Sep 2026 18:23:54 +0900
Subject: [PATCH] Reject unbound preview and positional probe arguments

---
 WELA.ps1                       | 2 +-
 tests/Capi2Probe.Cli.Tests.ps1 | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/WELA.ps1 b/WELA.ps1
index 74e38d78..4cb795f7 100644
--- a/WELA.ps1
+++ b/WELA.ps1
@@ -2083,7 +2083,7 @@ if ($Cmd -eq 'wec-runtime' -and @($PSBoundParameters.Keys | Where-Object {$_ -no
     throw 'wec-runtime accepts only selected runtime IDs, source cap and a new result path. No command was run.'
 }
 if ($Cmd -ne 'capi2-probe' -and @($PSBoundParameters.Keys | Where-Object {$_ -like 'Capi2Probe*'}).Count) {throw 'Capi2Probe options require capi2-probe.'}
-if ($Cmd -eq 'capi2-probe' -and @($PSBoundParameters.Keys | Where-Object {$_ -notin @('Cmd','Capi2ProbeAction','Capi2ProbeOutputPath','Capi2ProbeTimeoutSeconds','Help')}).Count) {throw 'capi2-probe accepts only dedicated probe options.'}
+if ($Cmd -eq 'capi2-probe' -and ($args.Count -or @($PSBoundParameters.Keys | Where-Object {$_ -notin @('Cmd','Capi2ProbeAction','Capi2ProbeOutputPath','Capi2ProbeTimeoutSeconds','Help')}).Count)) {throw 'capi2-probe accepts only dedicated probe options.'}
 if ($Cmd -ne 'wmi-probe' -and @($PSBoundParameters.Keys | Where-Object {$_ -like 'WmiProbe*'}).Count) {throw 'WmiProbe options require wmi-probe.'}
 if ($Cmd -eq 'wmi-probe' -and @($PSBoundParameters.Keys | Where-Object {$_ -notin @('Cmd','WmiProbeAction','WmiProbeNamespace','WmiProbeOutputPath','WmiProbeTimeoutSeconds','Help')}).Count) {throw 'wmi-probe accepts only dedicated probe options.'}
 if ($Cmd -ne 'applocker-probe' -and @($PSBoundParameters.Keys | Where-Object {$_ -in @('AppLockerProbeAction','AppLockerProbeOutputPath','AppLockerProbeTimeoutSeconds')}).Count) {throw 'AppLocker probe options require applocker-probe.'}
diff --git a/tests/Capi2Probe.Cli.Tests.ps1 b/tests/Capi2Probe.Cli.Tests.ps1
index f77f8ed3..b6ae9292 100644
--- a/tests/Capi2Probe.Cli.Tests.ps1
+++ b/tests/Capi2Probe.Cli.Tests.ps1
@@ -1,6 +1,9 @@
 $ErrorActionPreference='Stop';$repo=Split-Path $PSScriptRoot -Parent;$engine=(Get-Process -Id $PID).Path;$count=0
+$preview=Join-Path ([IO.Path]::GetTempPath()) ('wela-capi2-whatif-'+[guid]::NewGuid().ToString('N'))
 $cases=@(
  @{Args=@('capi2-probe','-Help');Code=0;Pattern='Fixed offline'},
+ @{Args=@('capi2-probe','-Capi2ProbeAction','Run','-Capi2ProbeOutputPath',$preview,'-WhatIf');Code=1;Pattern='only dedicated'},
+ @{Args=@('capi2-probe','-Help','unexpected-positional-value');Code=1;Pattern='only dedicated'},
  @{Args=@('configure','-Capi2ProbeAction','Run','-Auto');Code=1;Pattern='require capi2-probe'},
  @{Args=@('wmi-auditing','-Capi2ProbeAction','Run');Code=1;Pattern='require capi2-probe'},
  @{Args=@('capi2-probe','-Help','-WmiAction','Configure');Code=1;Pattern='only dedicated'},
@@ -10,5 +13,6 @@ $cases=@(
  @{Args=@('capi2-probe','-Help','-Profile','wela-2.2.0');Code=1;Pattern='only dedicated'},
  @{Args=@('capi2-probe','-Capi2ProbeAction','Run');Code=1;Pattern='new Capi2ProbeOutputPath'})
 foreach($case in $cases){$ErrorActionPreference='Continue';$output=& $engine -NoProfile -NonInteractive -File (Join-Path $repo 'WELA.ps1') @($case.Args) 2>&1|Out-String;$code=$LASTEXITCODE;$ErrorActionPreference='Stop';if($code -ne $case.Code -or $output -notmatch $case.Pattern){throw "CLI failed: $($case.Args -join ' ') [$code] $output"};$count++}
+if(Test-Path -LiteralPath $preview){throw 'Unsupported preview created a probe output directory.'};$count++
 Write-Host "PASS: $count CAPI2 probe public CLI checks."
 $global:LASTEXITCODE=0