@codemod/azure-pipelines-script-injection-audit
Detect Azure Pipelines YAML steps that pass untrusted template parameters, runtime variables, or queue-time inputs into script-capable tasks and inline script blocks in ways that can enable command injection. Report exact locations, the interpolation source, the execution surface, and remediation guidance without modifying files.
Installation
Usage
This codemod is read-only. It audits Azure Pipelines YAML for inline script and script-capable task fields that interpolate template parameters, runtime variables, variable-group values, or other externally influenced expressions into shell-executed content.
It scans:
azure-pipelines.ymlandazure-pipelines.yaml- YAML under
.azure-pipelines/,pipelines/, and.ado/ - Referenced
template:andextends:YAML files inside the target repo
It reports findings for:
- Inline step keys:
script,bash,pwsh,powershell - Script-capable tasks such as
Bash,PowerShell,AzureCLI,CmdLine,BatchScript,ShellScript,PythonScript, andPowerShellOnTargetMachines - Task inputs that execute inline shell text or pass arguments into shell-capable tasks
It does not rewrite source files. Findings are emitted as structured runtime warnings and metrics, including:
azure_pipelines_script_injection_findingazure_pipelines_script_injection_by_surfaceazure_pipelines_script_injection_by_source_kindazure_pipelines_script_injection_by_task_familyazure_pipelines_script_injection_by_confidence
Each finding carries CWE-20, CWE-78, YAML location data, execution surface, source kind, template chain, and remediation guidance.
Detection Notes
- Inline script interpolation is treated as suspicious by default, including quoted interpolation.
env:assignments are not reported by themselves.- Non-script task fields such as
UsePythonVersion.inputs.versionSpecare excluded. - Script file path references such as
filePathare excluded unless shell-executed arguments are also interpolated. - Simple template pass-through is resolved for in-repo
template:andextends:chains.
Development
License
MIT