fix(security): neutralize VSO pipeline commands in Stage 3 log output

[Copilot]

##vso[ and ##[ ADO logging commands survive control-character filtering (they're pure printable ASCII) and reach println!() in Stage 3, where ADO executes them. Three independent paths — budget-exceeded skip messages, wiki page create messages, and wiki page update messages — all embed unsanitized structural fields (title, path) directly into stdout.

Changes

• src/sanitize.rs — expose neutralize_pipeline_commands as pub(crate) so call sites outside the module can apply it directly without the full sanitize_config pipeline (which preserves \n/\r, unsuitable for single-line log context strings)

• src/execute.rs — extract_entry_context — apply neutralize_pipeline_commands() to title and path fields after the existing control-char strip, before embedding in budget-exceeded log/result messages

• src/safeoutputs/create_wiki_page.rs + update_wiki_page.rs — sanitize_content_fields — same two-step fix for self.path; since effective_path derives from self.path via normalize_wiki_path, all downstream log messages (already-exists, success, PUT-failure) are covered by fixing the source

// Before — VSO commands survive
self.path = self.path.chars().filter(|c| !c.is_control() || *c == '\t').collect();

// After — control chars stripped, then VSO commands neutralized
self.path = neutralize_pipeline_commands(
    &self.path.chars().filter(|c| !c.is_control() || *c == '\t').collect::<String>(),
);

Test plan

Six new unit tests cover VSO neutralization in extract_entry_context (title and path variants) and sanitize_content_fields for both wiki tools. All 1107 existing tests pass.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• spsprodeus21.vssps.visualstudio.com
  • Triggering command: /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/ado_aw-f4dc8202a0574181 /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/ado_aw-f4dc8202a0574181 /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/clap_derive-28fe0dd3cb6f860c.c/home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/compiler_tests-08469b25c8713b9f.15ci54sqstm9plk9n8tzsxk8r.1qe2vi0.rcgu.o /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/clap_derive-28fe0dd3cb6f860c.c/home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/compiler_tests-08469b25c8713b9f.1osek3msodzrcuzzqb6j6fh5f.1qe2vi0.rcgu.o 64-REDACTED-linux-gnu/bin/rust-lld g/de�� lib/rustlib/x86_-Wl,--as-needed lib/rustlib/x86_-Wl,-Bstatic bin/rustc 7d86f546b9f25a26cc 7d86f546b9f25a26-Wl,--version-script=/home/REDACTED/work/ado-aw/ado-aw/target/debug/de�� eta.o bin/rustc s/yo�� (dns block)
  • Triggering command: /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/ado_aw-f4dc8202a0574181 /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/ado_aw-f4dc8202a0574181 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie 37a5vpfc9grf83tapm7.0xpk6kl.rcgu.o rj76ro2tx72g6l1dxch.0xpk6kl.rcgu.o 56xt4tnxr14dyslr5yr.0xpk6kl.rcgu.o weqouzvwj204cs9zx47.0xpk6kl.rcgu.o po14gdsp7nsb0tn5qm9.0xpk6kl.rcgu.o 96y3m5qgwp6gglv6gzw.0xpk6kl.rcgu.o miwqh6oxxjoxxgm9jcu.0xpk6kl.rcgu.o qfnfg1qskcufw1m67aj.0xpk6kl.rcgu.o wnrzufvl2f1ly2jz8mi.0xpk6kl.rcgu.o 3yebsirl7wtzt6zf02v.0xpk6kl.rcgu.o 11oaj82vgibvmk3tp2z.0xpk6kl.rcgu.o e0b09g2kmpl46vhzo4p.0xpk6kl.rcgu.o o0ca8e5y7ex48mielxx.0xpk6kl.rcgu.o bcccdvq2hpd05krunh5.0xpk6kl.rcgu.o (dns block)
  • Triggering command: /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/ado_aw-f4dc8202a0574181 /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/ado_aw-f4dc8202a0574181 s/ado_aw-f4dc820remote s/ado_aw-f4dc820get-url s/ado_aw-f4dc820origin s/ad�� s/ado_aw-f4dc8202a0574181.0qxja5qfnfg1qskcufw1m67aj.0xpk6kl.rcgu.o s/ado_aw-f4dc8202a0574181.0ryb47wnrzufvl2f1ly2jz8mi.0xpk6kl.rcgu.o s/ado_aw-f4dc8202a0574181.0ycrds3yebsirl7wtzt6zf02v.0xpk6kl.rcgu.o s/ado_aw-f4dc820git s/ado_aw-f4dc820remote s/ado_aw-f4dc820get-url s/ado_aw-f4dc820origin s/ad�� s/ado_aw-f4dc8202a0574181.140wwknpg2hs3lbfo0xzude6s.0xpk6kl.rcgu.o s/ado_aw-f4dc8202a0574181.162elvo6u7r6dhctftupulf54.0xpk6kl.rcgu.o u/13/liblto_plugin.so _64-linux-gnu/13git su8gH1.res target/debug/depget-url target/debug/deporigin (dns block)
• spsprodweu4.vssps.visualstudio.com
  • Triggering command: /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/ado_aw-f4dc8202a0574181 /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/ado_aw-f4dc8202a0574181 /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/clap_derive-28fe0dd3cb6f860c.c/home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/compiler_tests-08469b25c8713b9f.15ci54sqstm9plk9n8tzsxk8r.1qe2vi0.rcgu.o /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/clap_derive-28fe0dd3cb6f860c.c/home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/compiler_tests-08469b25c8713b9f.1osek3msodzrcuzzqb6j6fh5f.1qe2vi0.rcgu.o 64-REDACTED-linux-gnu/bin/rust-lld g/de�� lib/rustlib/x86_-Wl,--as-needed lib/rustlib/x86_-Wl,-Bstatic bin/rustc 7d86f546b9f25a26cc 7d86f546b9f25a26-Wl,--version-script=/home/REDACTED/work/ado-aw/ado-aw/target/debug/de�� eta.o bin/rustc s/yo�� (dns block)
  • Triggering command: /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/ado_aw-f4dc8202a0574181 /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/ado_aw-f4dc8202a0574181 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie 37a5vpfc9grf83tapm7.0xpk6kl.rcgu.o rj76ro2tx72g6l1dxch.0xpk6kl.rcgu.o 56xt4tnxr14dyslr5yr.0xpk6kl.rcgu.o weqouzvwj204cs9zx47.0xpk6kl.rcgu.o po14gdsp7nsb0tn5qm9.0xpk6kl.rcgu.o 96y3m5qgwp6gglv6gzw.0xpk6kl.rcgu.o miwqh6oxxjoxxgm9jcu.0xpk6kl.rcgu.o qfnfg1qskcufw1m67aj.0xpk6kl.rcgu.o wnrzufvl2f1ly2jz8mi.0xpk6kl.rcgu.o 3yebsirl7wtzt6zf02v.0xpk6kl.rcgu.o 11oaj82vgibvmk3tp2z.0xpk6kl.rcgu.o e0b09g2kmpl46vhzo4p.0xpk6kl.rcgu.o o0ca8e5y7ex48mielxx.0xpk6kl.rcgu.o bcccdvq2hpd05krunh5.0xpk6kl.rcgu.o (dns block)
  • Triggering command: /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/ado_aw-f4dc8202a0574181 /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/ado_aw-f4dc8202a0574181 s/ado_aw-f4dc820remote s/ado_aw-f4dc820get-url s/ado_aw-f4dc820origin s/ad�� s/ado_aw-f4dc8202a0574181.0qxja5qfnfg1qskcufw1m67aj.0xpk6kl.rcgu.o s/ado_aw-f4dc8202a0574181.0ryb47wnrzufvl2f1ly2jz8mi.0xpk6kl.rcgu.o s/ado_aw-f4dc8202a0574181.0ycrds3yebsirl7wtzt6zf02v.0xpk6kl.rcgu.o s/ado_aw-f4dc820git s/ado_aw-f4dc820remote s/ado_aw-f4dc820get-url s/ado_aw-f4dc820origin s/ad�� s/ado_aw-f4dc8202a0574181.140wwknpg2hs3lbfo0xzude6s.0xpk6kl.rcgu.o s/ado_aw-f4dc8202a0574181.162elvo6u7r6dhctftupulf54.0xpk6kl.rcgu.o u/13/liblto_plugin.so _64-linux-gnu/13git su8gH1.res target/debug/depget-url target/debug/deporigin (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)