DOS1115

Pipeline Settings - Enable shell tasks arguments validation

DOS1115

AzureDevOps organization high builtIn

Description

Enable shell tasks args sanitizing. When this is enabled, argument parameters for built-in shell tasks are validated to prevent additional shell commands from being executed. Learn more: https://learn.microsoft.com/en-us/azure/devops/pipelines/security/inputs#shellTasksValidation

Recommendation

1. Navigate to Organization Settings. 
2. Open the Settings link under Pipelines. 
3. Turn 'On' the setting 'Enable shell tasks arguments validation'.

Policy Rule

{
  "target": "ADOOrganizationPipelineSettings",
  "if": {
    "allOf": [
      {
        "resource": "ADOOrganizationPipelineSettings",
        "property": "EnableShellTasksArgsSanitizing",
        "operator": "equals",
        "value": true
      }
    ]
  },
  "then": {
    "effect": "Audit"
  }
}
« DOS1110 DOS1120 »
Rule Details
  • Rule ID: DOS1115
  • Code: ADO_Organization_Pipeline_Settings_Enable_Shell_Tasks_Arguments_Validation
  • Platform: AzureDevOps
  • Category: organization
  • Severity: high
  • Type: builtIn
Related Rules

Copyright © DevOps Shield. All Rights Reserved. Privacy Policy | Cookie Policy | Terms and Conditions