Skip to content

Commit 1329f50

Browse files
localconstlocalconst
authored
WI 2048209 (#18744)
* Update BashV3 * Update SshV0 * Update PowerShellV2 * Update sanitization message * Move back ps exit code message * Remove backticks from Bash & Ssh tasks * Add null stdout redirect for safety * Fix telemetry * Fix return from sanitizer * Remove escaping tags from help link * Bump bash
1 parent 3b9f9d0 commit 1329f50

File tree

20 files changed

+129
-84
lines changed

20 files changed

+129
-84
lines changed

‎Tasks/BashV3/Strings/resources.resjson/en-US/resources.resjson‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,5 +25,5 @@
2525
"loc.messages.JS_Stderr": "Bash wrote one or more lines to the standard error stream.",
2626
"loc.messages.JS_TranslatePathFailed": "Unable to translate the path '%s' to the Linux file system.",
2727
"loc.messages.JS_BashEnvAlreadyDefined": "The BASH_ENV environment variable has already been set to a '%s', the task will override it with '%s'",
28-
"loc.messages.SanitizerOutput": "Sanitizer changed input arguments. Output from sanitizer: '%s'"
28+
"loc.messages.ScriptArgsSanitized": "Detected characters in arguments that may not be executed correctly by the shell. Please escape special characters using backslash (\\). More information is available here: https://aka.ms/ado/75787"
2929
}

‎Tasks/BashV3/bash.ts‎

Lines changed: 16 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,9 @@ import fs = require('fs');
22
import path = require('path');
33
import tl = require('azure-pipelines-task-lib/task');
44
import tr = require('azure-pipelines-task-lib/toolrunner');
5-
import { sanitizeScriptArgs } from 'azure-pipelines-tasks-utility-common/argsSanitizer';
65
var uuidV4 = require('uuid/v4');
6+
import { sanitizeArgs } from 'azure-pipelines-tasks-utility-common/argsSanitizer';
7+
import { emitTelemetry } from "azure-pipelines-tasks-utility-common/telemetry";
78

89
async function runBashPwd(bashPath: string, directoryPath: string): Promise<string> {
910
let pwdOutput = '';
@@ -123,18 +124,25 @@ async function run() {
123124
telemetry: tl.getBoolFeatureFlag('AZP_75787_ENABLE_COLLECT')
124125
};
125126

126-
if (featureFlags.activate || featureFlags.activate || featureFlags.telemetry) {
127-
const sanitizedArgs = sanitizeScriptArgs(
127+
if (featureFlags.activate || featureFlags.audit || featureFlags.telemetry) {
128+
const [sanitizedArgs, telemetry] = sanitizeArgs(
128129
input_arguments,
129130
{
130131
argsSplitSymbols: '\\\\',
131-
warningLocSymbol: 'SanitizerOutput',
132-
telemetryFeature: 'BashV3',
133-
saniziteRegExp: /(?<!\\)([^a-zA-Z0-9\\` _'"\-=\/:\.])/g
132+
saniziteRegExp: new RegExp(`(?<!\\\\)([^a-zA-Z0-9\\\\ _'"\\-=\\/:.])`, 'g')
134133
}
135134
);
136-
if (featureFlags.activate) {
137-
resultArgs = sanitizedArgs;
135+
if (sanitizedArgs !== input_arguments) {
136+
if (featureFlags.telemetry && telemetry) {
137+
emitTelemetry('TaskHub', 'BashV3', telemetry);
138+
}
139+
const message = tl.loc('ScriptArgsSanitized');
140+
if (featureFlags.activate) {
141+
throw new Error(message);
142+
}
143+
if (featureFlags.audit) {
144+
tl.warning(message);
145+
}
138146
}
139147
}
140148

‎Tasks/BashV3/package-lock.json‎

Lines changed: 3 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Tasks/BashV3/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
"@types/mocha": "^9.1.1",
2222
"@types/node": "^16.11.39",
2323
"azure-pipelines-task-lib": "^4.4.0",
24-
"azure-pipelines-tasks-utility-common": "^3.225.0",
24+
"azure-pipelines-tasks-utility-common": "^3.225.1",
2525
"uuid": "^3.0.1"
2626
},
2727
"devDependencies": {

‎Tasks/BashV3/task.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
"version": {
1919
"Major": 3,
2020
"Minor": 226,
21-
"Patch": 1
21+
"Patch": 2
2222
},
2323
"releaseNotes": "Script task consistency. Added support for multiple lines and added support for Windows.",
2424
"minimumAgentVersion": "2.115.0",
@@ -122,6 +122,6 @@
122122
"JS_Stderr": "Bash wrote one or more lines to the standard error stream.",
123123
"JS_TranslatePathFailed": "Unable to translate the path '%s' to the Linux file system.",
124124
"JS_BashEnvAlreadyDefined": "The BASH_ENV environment variable has already been set to a '%s', the task will override it with '%s'",
125-
"SanitizerOutput": "Sanitizer changed input arguments. Output from sanitizer: '%s'"
125+
"ScriptArgsSanitized": "Detected characters in arguments that may not be executed correctly by the shell. Please escape special characters using backslash (\\). More information is available here: https://aka.ms/ado/75787"
126126
}
127127
}

‎Tasks/BashV3/task.loc.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
"version": {
1919
"Major": 3,
2020
"Minor": 226,
21-
"Patch": 1
21+
"Patch": 2
2222
},
2323
"releaseNotes": "ms-resource:loc.releaseNotes",
2424
"minimumAgentVersion": "2.115.0",
@@ -122,6 +122,6 @@
122122
"JS_Stderr": "ms-resource:loc.messages.JS_Stderr",
123123
"JS_TranslatePathFailed": "ms-resource:loc.messages.JS_TranslatePathFailed",
124124
"JS_BashEnvAlreadyDefined": "ms-resource:loc.messages.JS_BashEnvAlreadyDefined",
125-
"SanitizerOutput": "ms-resource:loc.messages.SanitizerOutput"
125+
"ScriptArgsSanitized": "ms-resource:loc.messages.ScriptArgsSanitized"
126126
}
127127
}

‎Tasks/PowerShellV2/Strings/resources.resjson/en-US/resources.resjson‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,12 +44,11 @@
4444
"loc.messages.JS_InvalidFilePath": "Invalid file path '%s'. A path to a .ps1 file is required.",
4545
"loc.messages.JS_Stderr": "PowerShell wrote one or more lines to the standard error stream.",
4646
"loc.messages.JS_InvalidTargetType": "Invalid target type '%s'. The value must be one of: 'filepath' or 'inline'",
47-
"loc.messages.JS_SanitizerOutput": "Sanitizer changed input arguments. Output from sanitizer: '%s'",
4847
"loc.messages.PS_ExitCode": "PowerShell exited with code '{0}'.",
4948
"loc.messages.PS_FormattedCommand": "Formatted command: {0}",
5049
"loc.messages.PS_InvalidActionPreference": "Invalid action preference for {0}: '{1}'. The value must be one of: {2}",
5150
"loc.messages.PS_InvalidFilePath": "Invalid file path '{0}'. A path to a .ps1 file is required.",
5251
"loc.messages.PS_UnableToDetermineExitCode": "Unexpected exception. Unable to determine the exit code from powershell.",
5352
"loc.messages.PS_InvalidTargetType": "Invalid target type '{0}'. The value must be one of: 'filepath' or 'inline'",
54-
"loc.messages.PS_SanitizerOutput": "Sanitizer changed input arguments. Output from sanitizer: '{0}'"
53+
"loc.messages.ScriptArgsSanitized": "Detected characters in arguments that may not be executed correctly by the shell. Please escape special characters using backtick (`). More information is available here: https://aka.ms/ado/75787"
5554
}

‎Tasks/PowerShellV2/helpers.ps1‎

Lines changed: 34 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -5,37 +5,53 @@ function Publish-Telemetry($Telemetry) {
55
Write-Host "##vso[telemetry.publish area=$area;feature=$feature]$telemetryJson"
66
}
77

8-
function Sanitize-FileArguments([string]$InputArgs) {
9-
10-
$featureFlags = @{
11-
audit = [System.Convert]::ToBoolean($env:AZP_75787_ENABLE_NEW_LOGIC_LOG)
12-
activate = [System.Convert]::ToBoolean($env:AZP_75787_ENABLE_NEW_LOGIC)
13-
telemetry = [System.Convert]::ToBoolean($env:AZP_75787_ENABLE_COLLECT)
8+
function Combine-Matches {
9+
param (
10+
[Parameter(Mandatory = $true)]
11+
[String[]]$Matches
12+
)
13+
14+
$matchesData = @{}
15+
foreach ($m in $Matches) {
16+
if ($matchesData.ContainsKey($m)) {
17+
$matchesData[$m]++
18+
}
19+
else {
20+
$matchesData[$m] = 1
21+
}
1422
}
1523

24+
return $matchesData
25+
}
26+
27+
function Sanitize-Arguments([string]$InputArgs) {
1628
$removedSymbolSign = '_#removed#_';
1729
$argsSplitSymbols = '``';
30+
[string[][]]$matchesChunks = @()
1831

1932
# We're splitting by ``, removing all suspicious characters and then join
2033
$argsArr = $InputArgs -split $argsSplitSymbols;
34+
35+
## '?<!`' - checking if before character no backtick. '^a-zA-Z0-9` _'"-' - checking if character is allowed. Insead replacing to #removed#
36+
$regex = '(?<!`)([^a-zA-Z0-9\\` _''"\-=\/:\.])'
2137
for ($i = 0; $i -lt $argsArr.Length; $i++ ) {
22-
## '?<!`' - checking if before character no backtick. '^a-zA-Z0-9` _'"-' - checking if character is allowed. Insead replacing to #removed#
23-
$argsArr[$i] = $argsArr[$i] -replace '(?<!`)([^a-zA-Z0-9\\` _''"\-=\/:\.])', $removedSymbolSign;
38+
[string[]]$matches = (Select-String $regex -input $argsArr[$i] -AllMatches) | ForEach-Object { $_.Matches }
39+
if ($null -ne $matches ) {
40+
$matchesChunks += , $matches;
41+
$argsArr[$i] = $argsArr[$i] -replace $regex, $removedSymbolSign;
42+
}
2443
}
2544

2645
$resultArgs = $argsArr -join $argsSplitSymbols;
2746

28-
if ( $resultArgs -like "*$removedSymbolSign*") {
29-
30-
if ($featureFlags.audit -or $featureFlags.activate) {
31-
Write-Warning (Get-VstsLocString -Key 'PS_SanitizerOutput' -ArgumentList $resultArgs);
32-
}
33-
34-
if ($featureFlags.telemetry) {
35-
$removedSymbolsCount = [regex]::matches($resultArgs, $removedSymbolSign).count
36-
Publish-Telemetry @{ 'removedSymbolsCount' = $removedSymbolsCount }
47+
$telemetry = $null
48+
if ( $resultArgs -ne $InputArgs) {
49+
$argMatches = $matchesChunks | ForEach-Object { $_ } | Where-Object { $_ -ne $null }
50+
$telemetry = @{
51+
removedSymbols = Combine-Matches -Matches $argMatches
52+
removedSymbolsCount = $argMatches.Count
3753
}
3854
}
3955

40-
return $resultArgs;
56+
return , $resultArgs, $telemetry;
4157
}

‎Tasks/PowerShellV2/package-lock.json‎

Lines changed: 3 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Tasks/PowerShellV2/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
"@types/mocha": "^5.2.7",
1818
"@types/node": "^16.11.39",
1919
"azure-pipelines-task-lib": "^4.4.0",
20-
"azure-pipelines-tasks-utility-common": "^3.225.0",
20+
"azure-pipelines-tasks-utility-common": "^3.225.1",
2121
"uuid": "^3.0.1"
2222
},
2323
"devDependencies": {

0 commit comments

Comments
 (0)