From be2e67c0a02d1b34d06d779c8b9a6adb7d7e4707 Mon Sep 17 00:00:00 2001
From: Loren Gordon <lorengordon@users.noreply.github.com>
Date: Tue, 18 Feb 2020 16:23:41 -0800
Subject: [PATCH 1/2] Tests that powershell processes inline powershell in args

---
 .../integration/files/file/base/issue-56195/test.ps1  |  7 +++++++
 tests/integration/modules/test_cmdmod.py              | 11 +++++++++++
 2 files changed, 18 insertions(+)
 create mode 100644 tests/integration/files/file/base/issue-56195/test.ps1

diff --git a/tests/integration/files/file/base/issue-56195/test.ps1 b/tests/integration/files/file/base/issue-56195/test.ps1
new file mode 100644
index 000000000000..90e721de93ea
--- /dev/null
+++ b/tests/integration/files/file/base/issue-56195/test.ps1
@@ -0,0 +1,7 @@
+[CmdLetBinding()]
+Param(
+  [SecureString] $SecureString
+)
+
+$Credential = New-Object System.Net.NetworkCredential("DummyId", $SecureString)
+$Credential.Password
diff --git a/tests/integration/modules/test_cmdmod.py b/tests/integration/modules/test_cmdmod.py
index 008b750423f6..4981634c3d69 100644
--- a/tests/integration/modules/test_cmdmod.py
+++ b/tests/integration/modules/test_cmdmod.py
@@ -491,3 +491,14 @@ def test_windows_env_handling(self):
         out = self.run_function('cmd.run', ['set'], env={"abc": "123", "ABC": "456"}).splitlines()
         self.assertIn('abc=123', out)
         self.assertIn('ABC=456', out)
+
+    @skipIf(not salt.utils.platform.is_windows(), 'minion is not windows')
+    def test_windows_powershell_script_args(self):
+        '''
+        Ensure that powershell processes inline script in args
+        '''
+        val = 'i like cheese'
+        args = '-SecureString (ConvertTo-SecureString -String "{0}" -AsPlainText -Force) -ErrorAction Stop'.format(val)
+        script = 'salt://issue-56195/test.ps1'
+        ret = self.run_function('cmd.script', [script], args=args, shell='powershell')
+        self.assertEqual(ret['stdout'], val)

From fcd1699f5e83144a14483c6dcf01abdd098d3970 Mon Sep 17 00:00:00 2001
From: Loren Gordon <lorengordon@users.noreply.github.com>
Date: Tue, 18 Feb 2020 15:22:56 -0800
Subject: [PATCH 2/2] Allows use of inline powershell for cmd.script args

Fixes #356195
---
 salt/modules/cmdmod.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/modules/cmdmod.py b/salt/modules/cmdmod.py
index eed7656a6ddd..72d34b296e0f 100644
--- a/salt/modules/cmdmod.py
+++ b/salt/modules/cmdmod.py
@@ -344,7 +344,7 @@ def _run(cmd,
         # The last item in the list [-1] is the current method.
         # The third item[2] in each tuple is the name of that method.
         if stack[-2][2] == 'script':
-            cmd = 'Powershell -NonInteractive -NoProfile -ExecutionPolicy Bypass -File ' + cmd
+            cmd = 'Powershell -NonInteractive -NoProfile -ExecutionPolicy Bypass {0}'.format(cmd.replace('"', '\\"'))
         elif encoded_cmd:
             cmd = 'Powershell -NonInteractive -EncodedCommand {0}'.format(cmd)
         else: