# Enable shell tasks arguments validation

Enable shell tasks arguments validation. A Maester check for Azure DevOps, Pipelines.

Source: https://maester.dev/docs/tests/AZDO.1025

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/sebastianclaesson" title="Sebastian Claesson · Original author"><img src="https://github.com/SebastianClaesson.png" alt="Sebastian Claesson" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/sebastianclaesson">Sebastian Claesson</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Azure DevOps · Pipelines · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AZDO.1025
```

## Overview

Enable Shell Task Validation to prevent code injection.

Rationale: Code injection through arguments parameters should be prevented.

#### Remediation action

Enable the policy to stop these requests and notifications.

1. Sign in to your organization.
2. Choose Organization settings.
3. Select Settings under Pipelines.
4. Go to the section "Task restrictions" and turn on "Enable shell tasks arguments validation"

**Results:**
This validation applies to the arguments parameter in the following specific tasks:

- PowerShell
- BatchScript
- Bash
- Ssh
- AzureFileCopy
- WindowsMachineFileCopy

#### Related links

- [Learn - Shell Tasks Validation](https://learn.microsoft.com/azure/devops/pipelines/security/inputs?view=azure-devops#shellTasksValidation)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AZDO.1025 |
| Severity | High |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Pipelines |
| Area | Engineering systems |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1059 Command and Scripting Interpreter, T1677 Poisoned Pipeline Execution |
| Supports controls | nist-800-53-r5:SI-10 |
| PowerShell test | [Test-AzdoOrganizationTaskRestrictionsShellTaskArgumentValidation](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1025.ps1) |
| Services | AzureDevOps |
| Learn more | [https://learn.microsoft.com/azure/devops/pipelines/security/inputs?view=azure-devops#shellTasksValidation](https://learn.microsoft.com/azure/devops/pipelines/security/inputs?view=azure-devops#shellTasksValidation) |

</details>

## Source

- Test: [`tests/maester/azure-devops/Test.AZDO.1025.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1025.ps1)
- Documentation: [`tests/maester/azure-devops/Test.AZDO.1025.md`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1025.md)