AZDO.1025 - Enable shell tasks arguments validation.
Overview
Enable Shell Task Validation to prevent code injection.
Rationale: Code injection through arguments parameters should be prevented.
Remediation action
Enable the policy to stop these requests and notifications.
- Sign in to your organization.
- Choose Organization settings.
- Select Settings under Pipelines.
- Go to the section "Task restrictions" and turn on "Enable shell tasks arguments validation"
Results: This validation applies to the arguments parameter in the following specific tasks:
- PowerShell
- BatchScript
- Bash
- Ssh
- AzureFileCopy
- WindowsMachineFileCopy
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | AZDO.1025 |
| Severity | High |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Pipelines |
| Area | Engineering systems |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1059 Command and Scripting Interpreter, T1677 Poisoned Pipeline Execution |
| Supports controls | nist-800-53-r5:SI-10 |
| PowerShell test | Test-AzdoOrganizationTaskRestrictionsShellTaskArgumentValidation |
| Services | AzureDevOps |
| Learn more | https://learn.microsoft.com/azure/devops/pipelines/security/inputs?view=azure-devops#shellTasksValidation |