@codemod/azure-pipelines-task-param-injection
Read-only mining codemod for Azure Pipelines YAML that detects task and script surfaces where dynamic pipeline expressions are interpolated into shell-executed command strings or forwarded argument fields.
What It Detects
- Top-level script-bearing steps such as
script,bash,pwsh, andpowershell - Task inputs such as
script,inlineScript,Inline,InlineScript,arguments,ScriptArguments,command,commandOptions,options,arg,args, andtargetArguments - Template expressions
${{ ... }}, macros$(...), runtime expressions$[ ... ], and simple locally derived variables that later flow into sensitive sinks - Risk context for inline script bodies, argument strings, command-option fields, and derived-variable cases
What It Excludes
- Non-executable metadata such as
displayName,condition,dependsOn, pool settings, and similar declarative fields - Literal-only values with no dynamic expressions
- Standalone
env:mappings that are not consumed in the same command sink - Parameter declarations or variable declarations by themselves unless a sensitive sink consumes the derived value
- Direct allowlisted parameter usage when the parameter declaration has explicit
values:enumeration and the expression is used as a standalone token
Reporting
This codemod does not rewrite source files.
For each finding it emits structured runtime warnings with:
file,line,column,yamlPath, andstepIndextaskType,taskRef,field, andsinkClassexpressionKind,sourceKind, andrisk- Evidence and remediation guidance for parameter and command injection risks, including
CWE-20andCWE-78mappings
It also emits these metrics via codemod:metrics:
azurepipelines_parameter_injection.findingazurepipelines_parameter_injection.files_with_findingsazurepipelines_parameter_injection.by_task_typeazurepipelines_parameter_injection.by_fieldazurepipelines_parameter_injection.by_expression_kindazurepipelines_parameter_injection.by_riskazurepipelines_parameter_injection.by_source_kindazurepipelines_parameter_injection.inline_vs_argumentazurepipelines_parameter_injection.allowlist_excluded
Target Files
azure-pipelines.ymlazure-pipelines.yaml.azure-pipelines/**/*.yml.azure-pipelines/**/*.yamlpipelines/**/*.ymlpipelines/**/*.yaml.ado/**/*.yml.ado/**/*.yaml
Usage
Remediation Guidance
- Avoid concatenating user-controlled parameters or variables into inline shell bodies.
- Prefer task-native structured inputs instead of raw argument strings.
- Map parameters through explicit allowlists before use.
- Pass arguments as separate validated values where the Azure task supports that shape.
- Use fixed command templates instead of forwarding untrusted extra-args strings.
License
MIT