Sanitize ScriptArguments in AzurePowerShellV2-V5 and ServiceFabricPowerShellV1 (MSRC 115118)

Tasks/AzureFileCopyV1/task.json

@@ -13,7 +13,7 @@
     "author": "Microsoft Corporation",
     "version": {
         "Major": 1,
-        "Minor": 274,
+        "Minor": 275,
         "Patch": 0
     },
     "demands": [

Tasks/AzureFileCopyV1/task.loc.json

@@ -13,7 +13,7 @@
   "author": "Microsoft Corporation",
   "version": {
     "Major": 1,
-    "Minor": 274,
+    "Minor": 275,
     "Patch": 0
   },
   "demands": [

Tasks/AzureFileCopyV2/task.json

@@ -13,7 +13,7 @@
   "author": "Microsoft Corporation",
   "version": {
     "Major": 2,
-    "Minor": 274,
+    "Minor": 275,
     "Patch": 0
   },
   "demands": [

Tasks/AzureFileCopyV2/task.loc.json

@@ -13,7 +13,7 @@
   "author": "Microsoft Corporation",
   "version": {
     "Major": 2,
-    "Minor": 274,
+    "Minor": 275,
     "Patch": 0
   },
   "demands": [

Tasks/AzureFileCopyV3/task.json

@@ -13,7 +13,7 @@
   "author": "Microsoft Corporation",
   "version": {
     "Major": 3,
-    "Minor": 274,
+    "Minor": 275,
     "Patch": 0
   },
   "demands": [

Tasks/AzureFileCopyV3/task.loc.json

@@ -13,7 +13,7 @@
   "author": "Microsoft Corporation",
   "version": {
     "Major": 3,
-    "Minor": 274,
+    "Minor": 275,
     "Patch": 0
   },
   "demands": [

Tasks/AzureFileCopyV4/task.json

@@ -13,7 +13,7 @@
   "author": "Microsoft Corporation",
   "version": {
     "Major": 4,
-    "Minor": 274,
+    "Minor": 275,
     "Patch": 0
   },
   "demands": [

Tasks/AzureFileCopyV4/task.loc.json

@@ -13,7 +13,7 @@
   "author": "Microsoft Corporation",
   "version": {
     "Major": 4,
-    "Minor": 274,
+    "Minor": 275,
     "Patch": 0
   },
   "demands": [

Tasks/AzureFileCopyV5/task.json

@@ -13,7 +13,7 @@
   "author": "Microsoft Corporation",
   "version": {
     "Major": 5,
-    "Minor": 274,
+    "Minor": 275,
     "Patch": 0
   },
   "demands": [

Tasks/AzureFileCopyV5/task.loc.json

@@ -13,7 +13,7 @@
   "author": "Microsoft Corporation",
   "version": {
     "Major": 5,
-    "Minor": 274,
+    "Minor": 275,
     "Patch": 0
   },
   "demands": [

Tasks/AzureFileCopyV6/task.json

@@ -13,7 +13,7 @@
   "author": "Microsoft Corporation",
   "version": {
     "Major": 6,
-    "Minor": 274,
+    "Minor": 275,
     "Patch": 2
   },
   "demands": [

Tasks/AzureFileCopyV6/task.loc.json

@@ -13,7 +13,7 @@
   "author": "Microsoft Corporation",
   "version": {
     "Major": 6,
-    "Minor": 274,
+    "Minor": 275,
     "Patch": 2
   },
   "demands": [

Tasks/AzurePowerShellV2/AzurePowerShell.ps1

@@ -1,6 +1,8 @@
 Trace-VstsEnteringInvocation $MyInvocation
 Import-VstsLocStrings "$PSScriptRoot\Task.json"
 
+Import-Module $PSScriptRoot\ps_modules\Sanitizer
+
 # Get inputs.
 $scriptType = Get-VstsInput -Name ScriptType -Require
 $scriptPath = Get-VstsInput -Name ScriptPath
@@ -21,6 +23,17 @@ if ($scriptArguments -match '[\r\n]') {
     throw (Get-VstsLocString -Key InvalidScriptArguments0 -ArgumentList $scriptArguments)
 }
 
+# Sanitize script arguments to prevent PowerShell command injection.
+# No-op unless BOTH the org-level "Enable shell tasks arguments validation"
+# toggle and the per-task pipeline feature flag are enabled.
+# See https://aka.ms/ado/75787 and Tasks/Common/Sanitizer/Invoke-ScriptArgumentSanitization.ps1.
+if ($scriptType -ne "InlineScript") {
+    Invoke-ScriptArgumentSanitization `
+        -InputArgs $scriptArguments `
+        -TaskName 'AzurePowerShellV2' `
+        -PipelineFeatureFlagName 'EnableAzurePowerShellArgumentsSanitization'
+}
+
 # string constants
 $otherVersion = "OtherVersion"
 $latestVersion = "LatestVersion"

Tasks/AzurePowerShellV2/Tests/DoesNotUnravelOutput.ps1

@@ -3,6 +3,7 @@ param()
 
 # Arrange.
 . $PSScriptRoot\..\..\..\Tests\lib\Initialize-Test.ps1
+Register-Mock Invoke-ScriptArgumentSanitization
 $targetAzurePs = "4.1.0"
 Register-Mock Get-VstsInput { "FilePath" } -- -Name ScriptType -Require
 Register-Mock Get-VstsInput { "$PSScriptRoot/DoesNotUnravelOutput_TargetScript.ps1" } -- -Name ScriptPath

Tasks/AzurePowerShellV2/Tests/PerformsBasicFlow.ps1

@@ -3,6 +3,7 @@ param()
 
 # Arrange.
 . $PSScriptRoot\..\..\..\Tests\lib\Initialize-Test.ps1
+Register-Mock Invoke-ScriptArgumentSanitization
 $targetAzurePs = "4.1.0"
 Register-Mock Get-VstsInput { "FilePath" } -- -Name ScriptType -Require
 Register-Mock Get-VstsInput { "$PSScriptRoot/PerformsBasicFlow_TargetScript.ps1" } -- -Name ScriptPath

Tasks/AzurePowerShellV2/Tests/RedirectsErrors.ps1

@@ -3,6 +3,7 @@ param()
 
 # Arrange.
 . $PSScriptRoot\..\..\..\Tests\lib\Initialize-Test.ps1
+Register-Mock Invoke-ScriptArgumentSanitization
 $targetAzurePs = "4.1.0"
 Register-Mock Get-VstsInput { "FilePath" } -- -Name ScriptType -Require
 Register-Mock Get-VstsInput { "$PSScriptRoot/RedirectsErrors_TargetScript.ps1" } -- -Name ScriptPath

Tasks/AzurePowerShellV2/Tests/RemovesFunctionsAndVariables.ps1

@@ -3,6 +3,7 @@ param()
 
 # Arrange.
 . $PSScriptRoot\..\..\..\Tests\lib\Initialize-Test.ps1
+Register-Mock Invoke-ScriptArgumentSanitization
 
 # Arrange the task inputs.
 $targetAzurePs = "4.1.0"

Tasks/AzurePowerShellV2/Tests/ThrowsForInvalidVersion.ps1

@@ -3,6 +3,7 @@ param()
 
 # Arrange.
 . $PSScriptRoot\..\..\..\Tests\lib\Initialize-Test.ps1
+Register-Mock Invoke-ScriptArgumentSanitization
 
 Register-Mock Get-VstsInput { "FilePath" } -- -Name ScriptType -Require
 Register-Mock Get-VstsInput { "foobar.ps1" } -- -Name ScriptPath

Tasks/AzurePowerShellV2/Tests/ThrowsWhenInvalidScriptArguments.ps1

@@ -3,6 +3,7 @@ param()
 
 # Arrange.
 . $PSScriptRoot\..\..\..\Tests\lib\Initialize-Test.ps1
+Register-Mock Invoke-ScriptArgumentSanitization
 foreach ($arguments in @( "script`rarguments", "script`narguments" )) {
     Unregister-Mock Get-VstsInput
     Register-Mock Get-VstsInput { $arguments } -- -Name ScriptArguments

Tasks/AzurePowerShellV2/Tests/ThrowsWhenInvalidScriptPath.ps1

@@ -3,6 +3,7 @@ param()
 
 # Arrange.
 . $PSScriptRoot\..\..\..\Tests\lib\Initialize-Test.ps1
+Register-Mock Invoke-ScriptArgumentSanitization
 foreach ($path in @( "script`rpath", "script`npath" )) {
     Unregister-Mock Get-VstsInput
     Register-Mock Get-VstsInput { "FilePath" } -- -Name ScriptType -Require

Tasks/AzurePowerShellV2/Tests/ValidateInlineScriptFlow.ps1

@@ -3,6 +3,7 @@ param()
 
 # Arrange.
 . $PSScriptRoot\..\..\..\Tests\lib\Initialize-Test.ps1
+Register-Mock Invoke-ScriptArgumentSanitization
 Unregister-Mock Get-VstsInput
 $targetAzurePs = "4.1.0"
 Register-Mock Get-VstsInput { "InlineScript" } -- -Name ScriptType -Require

Tasks/AzurePowerShellV2/make.json

@@ -7,6 +7,10 @@
         {
             "module": "../Common/TlsHelper_",
             "type": "ps"
+        },
+        {
+            "module": "../Common/Sanitizer",
+            "type": "ps"
         }
     ],
     "externals": {

Tasks/AzurePowerShellV2/task.json

@@ -17,7 +17,7 @@
     "author": "Microsoft Corporation",
     "version": {
         "Major": 2,
-        "Minor": 274,
+        "Minor": 275,
         "Patch": 0
     },
     "demands": [

Tasks/AzurePowerShellV2/task.loc.json

@@ -17,7 +17,7 @@
   "author": "Microsoft Corporation",
   "version": {
     "Major": 2,
-    "Minor": 274,
+    "Minor": 275,
     "Patch": 0
   },
   "demands": [

Tasks/AzurePowerShellV3/AzurePowerShell.ps1

@@ -1,6 +1,8 @@
 Trace-VstsEnteringInvocation $MyInvocation
 Import-VstsLocStrings "$PSScriptRoot\Task.json"
 
+Import-Module $PSScriptRoot\ps_modules\Sanitizer
+
 # Get inputs.
 $scriptType = Get-VstsInput -Name ScriptType -Require
 $scriptPath = Get-VstsInput -Name ScriptPath
@@ -25,6 +27,17 @@ if ($scriptArguments -match '[\r\n]') {
     throw (Get-VstsLocString -Key InvalidScriptArguments0 -ArgumentList $scriptArguments)
 }
 
+# Sanitize script arguments to prevent PowerShell command injection.
+# No-op unless BOTH the org-level "Enable shell tasks arguments validation"
+# toggle and the per-task pipeline feature flag are enabled.
+# See https://aka.ms/ado/75787 and Tasks/Common/Sanitizer/Invoke-ScriptArgumentSanitization.ps1.
+if ($scriptType -ne "InlineScript") {
+    Invoke-ScriptArgumentSanitization `
+        -InputArgs $scriptArguments `
+        -TaskName 'AzurePowerShellV3' `
+        -PipelineFeatureFlagName 'EnableAzurePowerShellArgumentsSanitization'
+}
+
 # string constants
 $otherVersion = "OtherVersion"
 $latestVersion = "LatestVersion"

Tasks/AzurePowerShellV3/Tests/DoesNotFailOnStandardError.ps1

@@ -3,6 +3,7 @@ param()
 
 # Arrange.
 . $PSScriptRoot\..\..\..\Tests\lib\Initialize-Test.ps1
+Register-Mock Invoke-ScriptArgumentSanitization
 $targetAzurePs = "4.1.0"
 Register-Mock Get-VstsInput { "FilePath" } -- -Name ScriptType -Require
 Register-Mock Get-VstsInput { "$PSScriptRoot/RedirectsErrors_TargetScript.ps1" } -- -Name ScriptPath

Tasks/AzurePowerShellV3/Tests/DoesNotThrowForNativeCommandError.ps1

@@ -3,6 +3,7 @@ param()
 
 # Arrange.
 . $PSScriptRoot\..\..\..\Tests\lib\Initialize-Test.ps1
+Register-Mock Invoke-ScriptArgumentSanitization
 $targetAzurePs = "4.1.0"
 Register-Mock Get-VstsInput { "FilePath" } -- -Name ScriptType -Require
 Register-Mock Get-VstsInput { "$PSScriptRoot/NativeCommandError_TargetScript.ps1" } -- -Name ScriptPath

Tasks/AzurePowerShellV3/Tests/DoesNotUnravelOutput.ps1

@@ -3,6 +3,7 @@ param()
 
 # Arrange.
 . $PSScriptRoot\..\..\..\Tests\lib\Initialize-Test.ps1
+Register-Mock Invoke-ScriptArgumentSanitization
 $targetAzurePs = "4.1.0"
 Register-Mock Get-VstsInput { "FilePath" } -- -Name ScriptType -Require
 Register-Mock Get-VstsInput { "$PSScriptRoot/DoesNotUnravelOutput_TargetScript.ps1" } -- -Name ScriptPath

Tasks/AzurePowerShellV3/Tests/FailsForNativeCommandError.ps1

@@ -3,6 +3,7 @@ param()
 
 # Arrange.
 . $PSScriptRoot\..\..\..\Tests\lib\Initialize-Test.ps1
+Register-Mock Invoke-ScriptArgumentSanitization
 $targetAzurePs = "4.1.0"
 Register-Mock Get-VstsInput { "FilePath" } -- -Name ScriptType -Require
 Register-Mock Get-VstsInput { "$PSScriptRoot/NativeCommandError_TargetScript.ps1" } -- -Name ScriptPath

Tasks/AzurePowerShellV3/Tests/PerformsBasicFlow.ps1

@@ -3,6 +3,7 @@ param()
 
 # Arrange.
 . $PSScriptRoot\..\..\..\Tests\lib\Initialize-Test.ps1
+Register-Mock Invoke-ScriptArgumentSanitization
 $targetAzurePs = "4.1.0"
 Register-Mock Get-VstsInput { "FilePath" } -- -Name ScriptType -Require
 Register-Mock Get-VstsInput { "$PSScriptRoot/PerformsBasicFlow_TargetScript.ps1" } -- -Name ScriptPath

Tasks/AzurePowerShellV3/Tests/RedirectsErrors.ps1

@@ -3,6 +3,7 @@ param()
 
 # Arrange.
 . $PSScriptRoot\..\..\..\Tests\lib\Initialize-Test.ps1
+Register-Mock Invoke-ScriptArgumentSanitization
 $targetAzurePs = "4.1.0"
 Register-Mock Get-VstsInput { "FilePath" } -- -Name ScriptType -Require
 Register-Mock Get-VstsInput { "$PSScriptRoot/RedirectsErrors_TargetScript.ps1" } -- -Name ScriptPath

Tasks/AzurePowerShellV3/Tests/RemovesFunctionsAndVariables.ps1

@@ -3,6 +3,7 @@ param()
 
 # Arrange.
 . $PSScriptRoot\..\..\..\Tests\lib\Initialize-Test.ps1
+Register-Mock Invoke-ScriptArgumentSanitization
 
 # Arrange the task inputs.
 $targetAzurePs = "4.1.0"

Tasks/AzurePowerShellV3/Tests/ThrowsForInvalidVersion.ps1

@@ -3,6 +3,7 @@ param()
 
 # Arrange.
 . $PSScriptRoot\..\..\..\Tests\lib\Initialize-Test.ps1
+Register-Mock Invoke-ScriptArgumentSanitization
 
 Register-Mock Get-VstsInput { "FilePath" } -- -Name ScriptType -Require
 Register-Mock Get-VstsInput { "foobar.ps1" } -- -Name ScriptPath

Tasks/AzurePowerShellV3/Tests/ThrowsWhenInvalidScriptArguments.ps1

@@ -3,6 +3,7 @@ param()
 
 # Arrange.
 . $PSScriptRoot\..\..\..\Tests\lib\Initialize-Test.ps1
+Register-Mock Invoke-ScriptArgumentSanitization
 foreach ($arguments in @( "script`rarguments", "script`narguments" )) {
     Unregister-Mock Get-VstsInput
     Register-Mock Get-VstsInput { $arguments } -- -Name ScriptArguments

Tasks/AzurePowerShellV3/Tests/ThrowsWhenInvalidScriptPath.ps1

@@ -3,6 +3,7 @@ param()
 
 # Arrange.
 . $PSScriptRoot\..\..\..\Tests\lib\Initialize-Test.ps1
+Register-Mock Invoke-ScriptArgumentSanitization
 foreach ($path in @( "script`rpath", "script`npath" )) {
     Unregister-Mock Get-VstsInput
     Register-Mock Get-VstsInput { "FilePath" } -- -Name ScriptType -Require

Tasks/AzurePowerShellV3/Tests/ValidateInlineScriptFlow.ps1

@@ -3,6 +3,7 @@ param()
 
 # Arrange.
 . $PSScriptRoot\..\..\..\Tests\lib\Initialize-Test.ps1
+Register-Mock Invoke-ScriptArgumentSanitization
 Unregister-Mock Get-VstsInput
 $targetAzurePs = "4.1.0"
 if([string]::IsNullOrEmpty($env:Agent_TempDirectory)) {

Tasks/AzurePowerShellV3/make.json

@@ -7,6 +7,10 @@
         {
             "module": "../Common/TlsHelper_",
             "type": "ps"
+        },
+        {
+            "module": "../Common/Sanitizer",
+            "type": "ps"
         }
     ],
     "externals": {

Tasks/AzurePowerShellV3/task.json

@@ -17,7 +17,7 @@
     "author": "Microsoft Corporation",
     "version": {
         "Major": 3,
-        "Minor": 274,
+        "Minor": 275,
         "Patch": 0
     },
     "releaseNotes": "Added support for Fail on standard error and ErrorActionPreference",

Tasks/AzurePowerShellV3/task.loc.json

@@ -17,7 +17,7 @@
   "author": "Microsoft Corporation",
   "version": {
     "Major": 3,
-    "Minor": 274,
+    "Minor": 275,
     "Patch": 0
   },
   "releaseNotes": "ms-resource:loc.releaseNotes",

Tasks/AzurePowerShellV4/AzurePowerShell.ps1

@@ -1,6 +1,8 @@
 Trace-VstsEnteringInvocation $MyInvocation
 Import-VstsLocStrings "$PSScriptRoot\Task.json"
 
+Import-Module $PSScriptRoot\ps_modules\Sanitizer
+
 # Get inputs.
 $scriptType = Get-VstsInput -Name ScriptType -Require
 $scriptPath = Get-VstsInput -Name ScriptPath
@@ -28,6 +30,17 @@ if ($scriptArguments -match '[\r\n]') {
     throw (Get-VstsLocString -Key InvalidScriptArguments0 -ArgumentList $scriptArguments)
 }
 
+# Sanitize script arguments to prevent PowerShell command injection.
+# No-op unless BOTH the org-level "Enable shell tasks arguments validation"
+# toggle and the per-task pipeline feature flag are enabled.
+# See https://aka.ms/ado/75787 and Tasks/Common/Sanitizer/Invoke-ScriptArgumentSanitization.ps1.
+if ($scriptType -ne "InlineScript") {
+    Invoke-ScriptArgumentSanitization `
+        -InputArgs $scriptArguments `
+        -TaskName 'AzurePowerShellV4' `
+        -PipelineFeatureFlagName 'EnableAzurePowerShellArgumentsSanitization'
+}
+
 # string constants
 $otherVersion = "OtherVersion"
 $latestVersion = "LatestVersion"