fix(safeoutputs): block VSO command injection via repository alias across Stage 3 PR-safe-output executors#482
Merged
jamesadevine merged 4 commits intomainfrom May 9, 2026
Conversation
…peline commands Agent-Logs-Url: https://github.com/githubnext/ado-aw/sessions/349cfa4f-c108-45df-989a-99e9468287d2 Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>
Agent-Logs-Url: https://github.com/githubnext/ado-aw/sessions/349cfa4f-c108-45df-989a-99e9468287d2 Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Fix VSO command injection via unsanitized repository alias
fix(safeoutputs): block VSO command injection via repository alias in Stage 3 executors
May 9, 2026
Collaborator
|
/rust-review |
Contributor
|
✅ Rust PR Reviewer completed successfully! |
Contributor
🔍 Rust PR ReviewSummary: Fix is correct and well-structured, but incomplete — four more tools with Findings🐛 Bugs / Logic IssuesIncomplete fix — sibling tools still vulnerable at Stage 1 The PR patches four tools (
Example of the missing guard (same pattern as the PR): // In Validate for ResolvePrThreadParams / SubmitPrReviewParams / UpdatePrParams
if let Some(repository) = &self.repository {
reject_pipeline_injection(repository, "repository")?;
}
// In CreatePrParams validate (repository is Option<String>):
if let Some(repository) = &self.repository {
reject_pipeline_injection(repository, "repository")?;
}
// In SanitizeContent for CreatePrResult:
self.repository = self.repository.as_deref().map(sanitize_config);✅ What Looks Good
|
Collaborator
|
@copilot Apply the approach more broadly as suggested. |
…fe-output tools Agent-Logs-Url: https://github.com/githubnext/ado-aw/sessions/b7312f9d-b619-4ed9-8c59-6d3a96a7c7d8 Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>
Contributor
Author
Applied the broader hardening pass in 2c8a6e7: added Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Copilot
AI
changed the title
fix(safeoutputs): block VSO command injection via repository alias in Stage 3 executors
fix(safeoutputs): block VSO command injection via repository alias across Stage 3 PR-safe-output executors
May 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A red-team finding showed that
repositoryaliases could carry##vso[...]payloads into Stage 3 failure/log messages, allowing Azure DevOps command execution from executor stdout. This PR hardens both Stage 1 validation and Stage 3 sanitization for repository selectors across the affected and related PR-safe-output tools.Stage 3 sanitization hardening
sanitize_config(...)torepositoryin:add_pr_commentreply_to_pr_review_commentcreate_branchcreate_git_tagcreate_pr(broadened pass)Stage 1 input rejection
reject_pipeline_injection(..., "repository")inValidate::validate()for:add_pr_commentreply_to_pr_review_commentcreate_branchcreate_git_tagcreate_pr(broadened pass)submit_pr_review(broadened pass)resolve_pr_thread(broadened pass)update_pr(broadened pass)Coverage additions
Test plan
add_pr_commentreply_to_pr_commentcreate_branchcreate_git_tagcreate_prsubmit_pr_reviewresolve_pr_threadupdate_prcargo buildcargo testcargo clippy --all-targets --all-features