DOS2195

Pipeline Settings - Enable shell tasks arguments validation

DOS2195

AzureDevOps project Severityhigh builtIn

Description

Enable shell tasks args sanitizing. When this is enabled, argument parameters for built-in shell tasks are validated to prevent additional shell commands from being executed.

Learn More

Recommendation

1. Navigate to Project Settings. 
2. Open the Settings link under Pipelines. 
3. Turn 'On' the setting 'Enable shell tasks arguments validation'.

Policy Rule

{
  "target": "ADOProjectPipelineGeneralSettings",
  "if": {
    "allOf": [
      {
        "resource": "ADOProjectPipelineGeneralSettings",
        "property": "EnableShellTasksArgsSanitizing",
        "operator": "equals",
        "value": true
      }
    ]
  },
  "then": {
    "effect": "Audit"
  }
}
« DOS2190 DOS2200 »
Rule Details
  • Rule ID: DOS2195
  • Code: ADO_Project_Pipeline_Settings_Enable_Shell_Tasks_Arguments_Validation
  • Platform: AzureDevOps
  • Category: project
  • Severity: Severityhigh
  • Type: builtIn
Related Rules

Copyright © DevOps Shield. All Rights Reserved. Privacy Policy | Cookie Policy | Terms and Conditions