Fixes de-registering datastore options validation

[cgranleese-r7]

This PR addresses #21319.

The goal here was to address:

When a module deregisters an option, the validation process should ensure that it is not present when the module runs. It datastore['DEREGISTERED_OPTION'] should probably be nil but at the very least it should be #blank?.
Allowing the caller to pass datastore options that the module explicitly deregistered can break the module authors assumption of how library methods will behave.

This comment calls out some example modules that replicates the issue (thanks for writing those up @zeroSteiner, they were super helpful).

Before

After

Notes

Specs were added so we if the implementation is changed in the future we will know if options start leaking back in. I also added a spec to cover the shell to Meterpreter workflows.

TODO LIST

• Shell to Meterpreter workflows still needs tested manually
• Run Pros test suite

Verification

• Manually test the shell to Meterpreter workflows
• Pro test suite goes green
• Test modules work as expected
• Code changes are sane

[jenkins-eks-metasploit]

Additional test pipeline started ⌛
Note: build results only accessible to maintainers.

[jenkins-eks-metasploit]

Pipeline results available

Slice summary:

No test slices found.

Note: build results only accessible to maintainers.

[jenkins-eks-metasploit]

Additional test pipeline started ⌛
Note: build results only accessible to maintainers.

[Copilot]

Pull request overview

This PR addresses metasploit-framework issue #21319 by preventing options that a module has explicitly deregistered from being written into or read back out of a module’s datastore, and adds RSpec coverage to guard against regressions in common workflows (including shell-to-meterpreter handler/payload datastore sharing).

Changes:

• Add tracking of deregistered option keys inside Msf::ModuleDataStore and filter reads/writes for those keys.
• Ensure deregistration state is copied alongside datastore state (copy_state) and cleared when a key is re-registered (import_options).
• Add a new spec suite covering direct assignment, _import_extra_options, framework datastore fallback reads, re-registering previously-deregistered options, and share_datastore shell-to-meterpreter patterns.

Impact Analysis:

• Blast radius: high — Msf::ModuleDataStore is core infrastructure used broadly across module execution and inter-module workflows.
• Data and contract effects: changes datastore semantics for deregistered keys (they should no longer be observable); interactions with datastore merging/sharing/copying are particularly sensitive.
• Rollback and test focus: focus on module invocation from other modules, handler/payload datastore workflows, and any code paths that merge/copy datastores (e.g., console handler flows); rollback should be straightforward (single core file + specs) but correctness should be validated via the full test suite and targeted manual runs mentioned in the PR description.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
lib/msf/core/module_data_store.rb	Adds deregistered-key tracking and filtering hooks to prevent deregistered options from being set or resolved (including via framework datastore fallback).
spec/lib/msf/core/module_data_store_filter_spec.rb	Adds regression specs for deregistered option filtering across assignment/import/fallback/copy/share and re-registering scenarios.

[jenkins-eks-metasploit]

Pipeline results available

Slice summary:

• Test slice 1 - 🔴
• Test slice 3 - 🔴
• Test slice 4 - 🔴

Note: build results only accessible to maintainers.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

[jenkins-eks-metasploit]

Additional test pipeline started ⌛
Note: build results only accessible to maintainers.

[jenkins-eks-metasploit]

Pipeline results available

Slice summary:

• Test slice 1 - 🔴
• Test slice 2 - 🟢
• Test slice 4 - 🔴

Note: build results only accessible to maintainers.