Powershell Integration - System.Security.Cryptography.Xml Vulnerability

.gitignore

@@ -23,3 +23,4 @@ examples/perl/**/local/*
 **cpanfile.snapshot
 **/.modules/
 **/*.AppHost.TypeScript/nuget.config
+*.lscache

Directory.Packages.props

@@ -126,6 +126,7 @@
   <ItemGroup Label="System">
     <PackageVersion Include="System.Linq.Async" Version="6.0.1" />
     <PackageVersion Include="System.Linq.AsyncEnumerable" Version="$(DotNetExtensionsVersion)" />
+    <PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.6" />
   </ItemGroup>
   <ItemGroup Label="Overrides">
     <PackageVersion Include="Microsoft.Bcl.Memory" Version="9.0.14" />

src/CommunityToolkit.Aspire.Hosting.PowerShell/CommunityToolkit.Aspire.Hosting.PowerShell.csproj

@@ -8,6 +8,7 @@
   <ItemGroup>
     <PackageReference Include="Aspire.Hosting" />
     <PackageReference Include="Microsoft.PowerShell.SDK" />
+    <PackageReference Include="System.Security.Cryptography.Xml" />
   </ItemGroup>
 
   <ItemGroup>

src/CommunityToolkit.Aspire.Hosting.PowerShell/DistributedApplicationBuilderExtensions.cs

@@ -81,7 +81,9 @@ await builder.Eventing.PublishAsync(
             var poolName = res.Name;
             var poolLogger = loggerService.GetLogger(poolName);
 
-            _ = res.StartAsync(sessionState, notificationService, poolLogger, hostLifetime, ct);
+            // Await pool open so the resource isn't marked Running before the RunspacePool exists.
+            // Otherwise dependent scripts that WaitFor(pool) can race and hit a null Parent.Pool.
+            await res.StartAsync(sessionState, notificationService, poolLogger, hostLifetime, ct);
         });
 
         return poolBuilder;

src/CommunityToolkit.Aspire.Hosting.PowerShell/PowerShellScriptResource.cs

@@ -126,10 +126,22 @@ public async Task StartAsync(ILogger scriptLogger,
             CancellationToken cancellationToken = default)
         {
             scriptLogger.LogInformation("Starting PowerShell script '{ScriptName}'", Name);
-           
+
             Debug.Assert(scriptLogger is not null);
             _scriptLogger = scriptLogger;
 
+            // Aspire's WaitFor on the parent runspace pool doesn't reliably block here, so poll until
+            // the pool has been created AND opened by the parent resource before binding the PowerShell
+            // instance to it. Without this, _ps.RunspacePool can be null (hangs InvokeAsync) or in
+            // 'Opening' state (throws InvalidRunspacePoolStateException).
+            while ((Parent.Pool is null || Parent.Pool.RunspacePoolStateInfo.State != System.Management.Automation.Runspaces.RunspacePoolState.Opened)
+                && !cancellationToken.IsCancellationRequested)
+            {
+                await Task.Delay(TimeSpan.FromMilliseconds(50), cancellationToken).ConfigureAwait(false);
+            }
+
+            cancellationToken.ThrowIfCancellationRequested();
+
             Debug.Assert(Parent.Pool is not null);
             _ps.RunspacePool = Parent.Pool;