AZDO.1025 - Enable shell tasks arguments validation.
Overview
Enable Shell Task Validation to prevent code injection.
Rationale: Code injection through arguments parameters should be prevented.
Remediation action
Enable the policy to stop these requests and notifications.
- Sign in to your organization.
- Choose Organization settings.
- Select Settings under Pipelines.
- Go to the section "Task restrictions" and turn on "Enable shell tasks arguments validation"
Results: This validation applies to the arguments parameter in the following specific tasks:
- PowerShell
- BatchScript
- Bash
- Ssh
- AzureFileCopy
- WindowsMachineFileCopy
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | AZDO.1025 |
| Severity | High |
| Suite | Maester |
| Category | Azure DevOps |
| PowerShell test | Test-AzdoOrganizationTaskRestrictionsShellTaskArgumentValidation |
| Services | AzureDevOps |
| Learn more | https://learn.microsoft.com/azure/devops/pipelines/security/inputs?view=azure-devops#shellTasksValidation |
| Tags | AZDO, AZDO.1025 |
Source
- Test:
tests/Maester/AzureDevOps/Test.AZDO.1025.ps1 - Documentation:
tests/Maester/AzureDevOps/Test.AZDO.1025.md