Skip to content

Update Enable shell tasks arguments validation task list #14371

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wawanawna wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Update Enable shell tasks arguments validation task list #14371

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a28fcad
Update Enable shell tasks arguments validation task list
Copilot May 12, 2026
2e60116
Simplify: drop internal task versions and feature-flag note
Copilot May 12, 2026
68bc6e3
Use 'arguments' (plural) for consistency with task input name
Copilot May 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 10 additions & 4 deletions docs/pipelines/security/inputs.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
---
title: Securely use variables and parameters
description: Find out how to safely accept input from pipeline users in Azure Pipelines.
ms.date: 08/15/2025
ms.date: 05/12/2026
monikerRange: "<=azure-devops"
#customer intent: As an Azure Pipeline administrator, I want to understand how to securely accept user input so I can avoid security risks from variable and parameter usage in my pipelines.
ms.topic: best-practice
Expand Down Expand Up @@ -119,14 +119,20 @@ A running pipeline can't modify pipeline parameters, unlike variables. Parameter

Pipelines can reference tasks executed within the pipeline. Some tasks include an `arguments` parameter that allows users to specify more options for the task.

Applying the **Enable shell tasks arguments validation** setting validates `argument` parameters for built-in shell tasks to check for inputs that can inject commands into scripts. The check ensures that the shell correctly executes characters like semicolons, quotes, and parentheses in the following pipeline tasks:
Applying the **Enable shell tasks arguments validation** setting validates `arguments` parameters for built-in shell tasks to check for inputs that can inject commands into scripts. The check ensures that the shell correctly executes characters like semicolons, quotes, and parentheses in the following pipeline tasks:

- PowerShell
- PowerShell
- BatchScript
- Bash
- Bash
- Ssh
- AzureFileCopy
- WindowsMachineFileCopy
- PowerShellOnTargetMachines
- SqlAzureDacpacDeployment
- SqlDacpacDeploymentOnMachineGroup
- AzureCLI
- AzurePowerShell
- ServiceFabricPowerShell

You can apply **Enable shell tasks arguments validation** at the organization level under **Organization Settings** > **Pipelines** > **Settings** or at the project level under **Project settings** > **Pipelines** > **Settings**. If the organization-level setting is enabled, it applies to all projects in the organization and can't be turned off at the project level.

Expand Down