From a28fcad1157730314ab2cfeb09caabc5248ef361 Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Tue, 12 May 2026 16:56:08 +0200 Subject: [PATCH 1/3] Update Enable shell tasks arguments validation task list The section was last refreshed in September 2023 (commit 6cab6dc) when the original sanitizer shipped for PowerShell, Bash, Ssh, AzureFileCopy, and WindowsMachineFileCopy. Four subsequent retrofit PRs in microsoft/azure- pipelines-tasks added sanitization to additional task families but the docs were never updated: - microsoft/azure-pipelines-tasks#21947 (2026-04-16): SqlAzureDacpacDeployment, SqlDacpacDeploymentOnMachineGroup - microsoft/azure-pipelines-tasks#21968 (2026-04-15): PowerShellOnTargetMachines - microsoft/azure-pipelines-tasks#22066 (2026-04-28): AzureCLI v2/v3 - microsoft/azure-pipelines-tasks#22163 (in flight, MSRC 115118): AzurePowerShell v2-v5, ServiceFabricPowerShell v1 Also adds a note about the dual-gate model used by the post-2023 retrofits: the org-level setting now requires a per-task pipeline-level feature flag to be on as well, which Microsoft rolls out gradually to avoid regressing pipelines that opted in early. Task versions in the list reflect the actual on-disk task.json versions in the azure-pipelines-tasks repo as of today. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- docs/pipelines/security/inputs.md | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) diff --git a/docs/pipelines/security/inputs.md b/docs/pipelines/security/inputs.md index 175eaa233cf..3be5d5b7092 100644 --- a/docs/pipelines/security/inputs.md +++ b/docs/pipelines/security/inputs.md @@ -1,7 +1,7 @@ --- title: Securely use variables and parameters description: Find out how to safely accept input from pipeline users in Azure Pipelines. -ms.date: 08/15/2025 +ms.date: 05/12/2026 monikerRange: "<=azure-devops" #customer intent: As an Azure Pipeline administrator, I want to understand how to securely accept user input so I can avoid security risks from variable and parameter usage in my pipelines. ms.topic: best-practice @@ -121,12 +121,21 @@ Pipelines can reference tasks executed within the pipeline. Some tasks include a Applying the **Enable shell tasks arguments validation** setting validates `argument` parameters for built-in shell tasks to check for inputs that can inject commands into scripts. The check ensures that the shell correctly executes characters like semicolons, quotes, and parentheses in the following pipeline tasks: -- PowerShell -- BatchScript -- Bash -- Ssh -- AzureFileCopy -- WindowsMachineFileCopy +- PowerShell (`PowerShell@2`) +- BatchScript (`BatchScript@1`) +- Bash (`Bash@3`) +- Ssh (`Ssh@0`) +- AzureFileCopy (`AzureFileCopy@1` – `AzureFileCopy@6`) +- WindowsMachineFileCopy (`WindowsMachineFileCopy@1` – `WindowsMachineFileCopy@2`) +- PowerShellOnTargetMachines (`PowerShellOnTargetMachines@3`) +- SqlAzureDacpacDeployment (`SqlAzureDacpacDeployment@1`) +- SqlDacpacDeploymentOnMachineGroup (`SqlDacpacDeploymentOnMachineGroup@0`) +- AzureCLI (`AzureCLI@2`, `AzureCLI@3`) +- AzurePowerShell (`AzurePowerShell@2` – `AzurePowerShell@5`) +- ServiceFabricPowerShell (`ServiceFabricPowerShell@1`) + +> [!NOTE] +> For tasks added to the list after the original 2023 rollout (PowerShellOnTargetMachines, SqlAzureDacpacDeployment, SqlDacpacDeploymentOnMachineGroup, AzureCLI, AzurePowerShell, ServiceFabricPowerShell), argument sanitization fires only when **both** the org-level **Enable shell tasks arguments validation** setting and a per-task pipeline-level feature flag are enabled. The per-task feature flags are rolled out gradually by Microsoft to avoid regressions for pipelines that opted into the org-level setting before these tasks were onboarded. Customers do not need to take action; the per-task flags are managed centrally. You can apply **Enable shell tasks arguments validation** at the organization level under **Organization Settings** > **Pipelines** > **Settings** or at the project level under **Project settings** > **Pipelines** > **Settings**. If the organization-level setting is enabled, it applies to all projects in the organization and can't be turned off at the project level. From 2e601164d3086a8ded9d3a9cd2c1c44e6628b1f8 Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Tue, 12 May 2026 17:13:55 +0200 Subject: [PATCH 2/3] Simplify: drop internal task versions and feature-flag note Per review feedback - task version numbers and the internal per-task feature-flag mechanism are Microsoft implementation details that don't belong in the customer-facing docs. The page only needs the list of task families that participate in the validation. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- docs/pipelines/security/inputs.md | 27 ++++++++++++--------------- 1 file changed, 12 insertions(+), 15 deletions(-) diff --git a/docs/pipelines/security/inputs.md b/docs/pipelines/security/inputs.md index 3be5d5b7092..014ef26a8aa 100644 --- a/docs/pipelines/security/inputs.md +++ b/docs/pipelines/security/inputs.md @@ -121,21 +121,18 @@ Pipelines can reference tasks executed within the pipeline. Some tasks include a Applying the **Enable shell tasks arguments validation** setting validates `argument` parameters for built-in shell tasks to check for inputs that can inject commands into scripts. The check ensures that the shell correctly executes characters like semicolons, quotes, and parentheses in the following pipeline tasks: -- PowerShell (`PowerShell@2`) -- BatchScript (`BatchScript@1`) -- Bash (`Bash@3`) -- Ssh (`Ssh@0`) -- AzureFileCopy (`AzureFileCopy@1` – `AzureFileCopy@6`) -- WindowsMachineFileCopy (`WindowsMachineFileCopy@1` – `WindowsMachineFileCopy@2`) -- PowerShellOnTargetMachines (`PowerShellOnTargetMachines@3`) -- SqlAzureDacpacDeployment (`SqlAzureDacpacDeployment@1`) -- SqlDacpacDeploymentOnMachineGroup (`SqlDacpacDeploymentOnMachineGroup@0`) -- AzureCLI (`AzureCLI@2`, `AzureCLI@3`) -- AzurePowerShell (`AzurePowerShell@2` – `AzurePowerShell@5`) -- ServiceFabricPowerShell (`ServiceFabricPowerShell@1`) - -> [!NOTE] -> For tasks added to the list after the original 2023 rollout (PowerShellOnTargetMachines, SqlAzureDacpacDeployment, SqlDacpacDeploymentOnMachineGroup, AzureCLI, AzurePowerShell, ServiceFabricPowerShell), argument sanitization fires only when **both** the org-level **Enable shell tasks arguments validation** setting and a per-task pipeline-level feature flag are enabled. The per-task feature flags are rolled out gradually by Microsoft to avoid regressions for pipelines that opted into the org-level setting before these tasks were onboarded. Customers do not need to take action; the per-task flags are managed centrally. +- PowerShell +- BatchScript +- Bash +- Ssh +- AzureFileCopy +- WindowsMachineFileCopy +- PowerShellOnTargetMachines +- SqlAzureDacpacDeployment +- SqlDacpacDeploymentOnMachineGroup +- AzureCLI +- AzurePowerShell +- ServiceFabricPowerShell You can apply **Enable shell tasks arguments validation** at the organization level under **Organization Settings** > **Pipelines** > **Settings** or at the project level under **Project settings** > **Pipelines** > **Settings**. If the organization-level setting is enabled, it applies to all projects in the organization and can't be turned off at the project level. From 68bc6e375fbee084d24bd4cca6ca857abf21585a Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Wed, 13 May 2026 12:28:24 +0200 Subject: [PATCH 3/3] Use 'arguments' (plural) for consistency with task input name Addresses PR review feedback: the surrounding text and the actual task input are both named 'arguments', so the singular 'argument' on line 122 was an internal inconsistency. Now reads 'validates `arguments` parameters' matching the previous sentence's `arguments` reference. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- docs/pipelines/security/inputs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/pipelines/security/inputs.md b/docs/pipelines/security/inputs.md index 014ef26a8aa..8554bd82ca0 100644 --- a/docs/pipelines/security/inputs.md +++ b/docs/pipelines/security/inputs.md @@ -119,7 +119,7 @@ A running pipeline can't modify pipeline parameters, unlike variables. Parameter Pipelines can reference tasks executed within the pipeline. Some tasks include an `arguments` parameter that allows users to specify more options for the task. -Applying the **Enable shell tasks arguments validation** setting validates `argument` parameters for built-in shell tasks to check for inputs that can inject commands into scripts. The check ensures that the shell correctly executes characters like semicolons, quotes, and parentheses in the following pipeline tasks: +Applying the **Enable shell tasks arguments validation** setting validates `arguments` parameters for built-in shell tasks to check for inputs that can inject commands into scripts. The check ensures that the shell correctly executes characters like semicolons, quotes, and parentheses in the following pipeline tasks: - PowerShell - BatchScript