Update powershell sanitizer regex

Tasks/AzureFileCopyV1/task.json

@@ -13,8 +13,8 @@
     "author": "Microsoft Corporation",
     "version": {
         "Major": 1,
-        "Minor": 228,
-        "Patch": 1
+        "Minor": 229,
+        "Patch": 0
     },
     "demands": [
         "azureps"

Tasks/AzureFileCopyV1/task.loc.json

@@ -13,8 +13,8 @@
   "author": "Microsoft Corporation",
   "version": {
     "Major": 1,
-    "Minor": 228,
-    "Patch": 1
+    "Minor": 229,
+    "Patch": 0
   },
   "demands": [
     "azureps"

Tasks/AzureFileCopyV2/task.json

@@ -13,8 +13,8 @@
   "author": "Microsoft Corporation",
   "version": {
     "Major": 2,
-    "Minor": 228,
-    "Patch": 3
+    "Minor": 229,
+    "Patch": 1
   },
   "demands": [
     "azureps"

Tasks/AzureFileCopyV2/task.loc.json

@@ -13,8 +13,8 @@
   "author": "Microsoft Corporation",
   "version": {
     "Major": 2,
-    "Minor": 228,
-    "Patch": 3
+    "Minor": 229,
+    "Patch": 1
   },
   "demands": [
     "azureps"

Tasks/AzureFileCopyV3/task.json

@@ -13,8 +13,8 @@
   "author": "Microsoft Corporation",
   "version": {
     "Major": 3,
-    "Minor": 228,
-    "Patch": 3
+    "Minor": 229,
+    "Patch": 1
   },
   "demands": [
     "azureps"

Tasks/AzureFileCopyV3/task.loc.json

@@ -13,8 +13,8 @@
   "author": "Microsoft Corporation",
   "version": {
     "Major": 3,
-    "Minor": 228,
-    "Patch": 3
+    "Minor": 229,
+    "Patch": 1
   },
   "demands": [
     "azureps"

Tasks/AzureFileCopyV4/task.json

@@ -13,8 +13,8 @@
     "author": "Microsoft Corporation",
     "version": {
         "Major": 4,
-        "Minor": 228,
-        "Patch": 1
+        "Minor": 229,
+        "Patch": 0
     },
     "demands": [
         "azureps"

Tasks/AzureFileCopyV4/task.loc.json

@@ -13,8 +13,8 @@
   "author": "Microsoft Corporation",
   "version": {
     "Major": 4,
-    "Minor": 228,
-    "Patch": 1
+    "Minor": 229,
+    "Patch": 0
   },
   "demands": [
     "azureps"

Tasks/AzureFileCopyV5/task.json

@@ -13,8 +13,8 @@
     "author": "Microsoft Corporation",
     "version": {
         "Major": 5,
-        "Minor": 228,
-        "Patch": 1
+        "Minor": 229,
+        "Patch": 0
     },
     "demands": [
         "azureps"

Tasks/AzureFileCopyV5/task.loc.json

@@ -13,8 +13,8 @@
   "author": "Microsoft Corporation",
   "version": {
     "Major": 5,
-    "Minor": 228,
-    "Patch": 1
+    "Minor": 229,
+    "Patch": 0
   },
   "demands": [
     "azureps"

Tasks/Common/Sanitizer/ArgumentsSanitizer.ps1

@@ -60,7 +60,7 @@ function Get-SanitizedArguments([string]$inputArgs) {
 
     # regex rule for removing symbols and telemetry.
     # '?<!`' - checking if before character no backtick. '([allowedchars])' - checking if character is allowed. Otherwise, replace to $removedSymbolSign
-    $regex = '(?<!\\)([^a-zA-Z0-9\\ _''"\-=/:.])';
+    $regex = '(?<!`)([^a-zA-Z0-9\\` _''"\-=\/:\.*,+~?%\n])';
 
     # We're splitting by ``, removing all suspicious characters and then join
     $argsArr = $inputArgs -split $argsSplitSymbols;
@@ -71,8 +71,6 @@ function Get-SanitizedArguments([string]$inputArgs) {
             $matchesChunks += , $matches;
             $argsArr[$i] = $argsArr[$i] -replace $regex, $removedSymbolSign;
         }
-
-        $argsArr[$i] = $argsArr[$i] -replace $regex, $removedSymbolSign;
     }
 
     $resultArgs = $argsArr -join $argsSplitSymbols;

Tasks/Common/Sanitizer/Strings/resources.resjson/en-US/resources.resjson

@@ -1,4 +1,4 @@
 {
-  "loc.messages.PS_ScriptArgsSanitized": "Detected characters in arguments that may not be executed correctly by the shell.  Please escape special characters using backtick (`). More information is available here: <https://aka.ms/ado/75787>",
+  "loc.messages.PS_ScriptArgsSanitized": "Detected characters in arguments that may not be executed correctly by the shell.  Please escape special characters using backtick (`). More information is available here: https://aka.ms/ado/75787",
   "loc.messages.PS_ScriptArgsNotSanitized": "Arguments passed sanitization without change."
 }

Tasks/Common/Sanitizer/Tests/L0.ts

@@ -1,12 +1,9 @@
 /// <reference path="../../../../definitions/mocha.d.ts"/>
 /// <reference path="../../../../definitions/node.d.ts"/>
-/// <reference path="../../../../definitions/Q.d.ts"/>
 
-import Q = require('q');
-import assert = require('assert');
 import path = require('path');
 
-var psm = require('../../../Tests/lib/psRunner');
+var psm = require('../../../../Tests/lib/psRunner');
 var psr = null;
 
 describe('Security Suite', function () {
@@ -49,4 +46,16 @@ describe('Security Suite', function () {
             psr.run(path.join(__dirname, 'L0Get-SanitizedArgumentsArray.DoesNotBreakExistingBashFormats.ps1'), done);
         });
     }
-});
+
+    if (psm.testSupported()) {
+        it('Protect-ScriptArguments should pass correctly', (done) => {
+            psr.run(path.join(__dirname, 'L0Protect-ScriptArguments.Passes.ps1'), done);
+        });
+    }
+
+    if (psm.testSupported()) {
+        it('Protect-ScriptArguments should throw', (done) => {
+            psr.run(path.join(__dirname, 'L0Protect-ScriptArguments.Throws.ps1'), done);
+        });
+    }
+});

Tasks/Common/Sanitizer/Tests/L0Get-SanitizedArgumentsArray.DoesNotBreakExistingBashFormats.ps1

@@ -21,5 +21,5 @@ foreach ($argument in $bashArgumentsFormats) {
     $sanitizedArguments = Get-SanitizedArguments -InputArgs $argument
 
     # Assert
-    Assert-AreEqual $sanitizedArguments $argument
-}
+    Assert-AreEqual -Actual $sanitizedArguments -Expected $argument
+}

Tasks/Common/Sanitizer/Tests/L0Get-SanitizedArgumentsArray.DoesNotBreakExistingCmdFormats.ps1

@@ -20,5 +20,5 @@ foreach ($argument in $cmdArgumentsFormats) {
     $sanitizedArguments = Get-SanitizedArguments -InputArgs $argument
 
     # Assert
-    Assert-AreEqual $sanitizedArguments $argument
+    Assert-AreEqual -Actual $sanitizedArguments -Expected $argument
 }

Tasks/Common/Sanitizer/Tests/L0Get-SanitizedArgumentsArray.DoesNotBreakExistingPowerShellFormats.ps1

@@ -21,5 +21,5 @@ foreach ($argument in $powershellArgumentsFormats) {
     $sanitizedArguments = Get-SanitizedArguments -InputArgs $argument
 
     # Assert
-    Assert-AreEqual $sanitizedArguments $argument
+    Assert-AreEqual -Actual $sanitizedArguments -Expected $argument
 }

Tasks/Common/Sanitizer/Tests/L0Get-SanitizedArgumentsArray.ReplacesForbiddenCharacters.ps1

@@ -14,5 +14,5 @@ $sanitizedArguments = Get-SanitizedArguments -InputArgs $arguments
 
 # Assert
 
-# We need to use $sanitizedArguments[1] because $sanitizedArguments contains buffer with Write-Output message from the function execution. 
-Assert-AreEqual $sanitizedArguments[1] "start notepad.exe _#removed#_ echo 'hello' _#removed#_ calc.exe"
+# We need to use $sanitizedArguments[1] because $sanitizedArguments contains buffer with Write-Output message from the function execution.
+Assert-AreEqual -Expected "start notepad.exe _#removed#_ echo 'hello' _#removed#_ calc.exe" -Actual $sanitizedArguments

Tasks/Common/Sanitizer/Tests/L0Protect-ScriptArguments.Passes.ps1

@@ -0,0 +1,41 @@
+[CmdletBinding()]
+param()
+
+Set-Item -Path env:AZP_75787_ENABLE_NEW_LOGIC -Value 'true'
+
+. $PSScriptRoot\..\..\..\..\Tests\lib\Initialize-Test.ps1
+. $PSScriptRoot\..\ArgumentsSanitizer.ps1
+
+$inputArgsSuites = @(
+    "/parameter",                               # Traditional way to pass parameters in CMD
+    "-parameter",                               # Modern applications accept parameters with a hyphen
+    "--parameter",                              # Many modern applications accept parameters with double hyphen
+    "parameter=value",                          # Format for passing values to parameters
+    "parameter value.txt",                      # Argument with dot in the middle
+    "-parameter",                               # Single hyphen followed by a single letter or digit (POSIX style)
+    "-parameter value",                         # When the parameter needs a value
+    "--parameter",                              # Double hyphen followed by a word (GNU style)
+    "--parameter=value",                        # Value directly attached to the parameter with an equals sign
+    "parameter=value",                          # Used to pass environment variables to a command
+    "parameter value.txt",                      # Argument with dot in the middle
+    "-Parameter Value",                         # Most common form
+    "-Parameter:Value",                         # Colon connects the parameter and its value
+    "/p:Parameter=Value",                       # Specific syntax for tools like MSBuild or NuGet
+    "--Parameter Value",                        # Used by cmdlets or scripts for cross-platform compatibility
+    "--Parameter=Value",                        # Used by cross-platform tools
+    "parameter value.txt"                       # Argument with dot in the middle
+    'a A 1 \ ` _ '' " - = / : . * , + ~ ? %',    # Just each allowed symbol
+    '',
+    'test 1',
+    'test `; whoami `&`& echo test',
+    "line 1 `n line 2"
+)
+
+foreach ($inputArgs in $inputArgsSuites) {
+    try {
+        Protect-ScriptArguments $inputArgs
+    }
+    catch {
+        throw "Error occured with '$inputArgs' input args: $($_.Exception.Message)"
+    }
+}

Tasks/Common/Sanitizer/Tests/L0Protect-ScriptArguments.Throws.ps1

@@ -0,0 +1,22 @@
+[CmdletBinding()]
+param()
+
+Set-Item -Path env:AZP_75787_ENABLE_NEW_LOGIC -Value 'true'
+
+. $PSScriptRoot\..\..\..\..\Tests\lib\Initialize-Test.ps1
+. $PSScriptRoot\..\ArgumentsSanitizer.ps1
+
+$inputArgsSuites = @(
+    'test; whoami',
+    'test && whoami',
+    'echo "$(rm ./somedir)"',
+    'test | whoami'
+)
+
+$expectedMsg = Get-VstsLocString -Key 'PS_ScriptArgsSanitized'
+
+foreach ($inputArgs in $inputArgsSuites) {
+    Assert-Throws {
+        Protect-ScriptArguments $inputArgs
+    } -MessagePattern $expectedMsg
+}

Tasks/Common/Sanitizer/Tests/L0Split-Arguments.ps1

@@ -33,5 +33,5 @@ for ($i = 0; $i -lt $argumentsFormats.Length; $i++) {
     [string[]]$splitArguments = Split-Arguments -arguments $argumentsFormats[$i]
 
     # Assert
-    Assert-AreEqual $splitArguments $expectedOutputs[$i]
-}
+    Assert-AreEqual -Expected $splitArguments -Actual $expectedOutputs[$i]
+}

Tasks/Common/Sanitizer/module.json

@@ -1,6 +1,6 @@
 {
     "messages": {
-        "PS_ScriptArgsSanitized": "Detected characters in arguments that may not be executed correctly by the shell.  Please escape special characters using backtick (`). More information is available here: <https://aka.ms/ado/75787>",
+        "PS_ScriptArgsSanitized": "Detected characters in arguments that may not be executed correctly by the shell.  Please escape special characters using backtick (`). More information is available here: https://aka.ms/ado/75787",
         "PS_ScriptArgsNotSanitized": "Arguments passed sanitization without change."
     }
 }

Tasks/Common/Sanitizer/runTests.ps1

@@ -0,0 +1,12 @@
+$startLoc = Get-Location
+
+Set-Location $PSScriptRoot/../../..
+
+try {
+    Remove-Item .\_build\Tasks\Common\Sanitizer -Recurse -Force -ErrorAction SilentlyContinue
+    node make build --task AzureFileCopyV5
+    node make test --task Common/Sanitizer
+}
+finally {
+    Set-Location $startLoc
+}

Tasks/WindowsMachineFileCopyV1/task.json

@@ -13,8 +13,8 @@
     "author": "Microsoft Corporation",
     "version": {
         "Major": 1,
-        "Minor": 228,
-        "Patch": 1
+        "Minor": 229,
+        "Patch": 0
     },
     "minimumAgentVersion": "1.104.0",
     "groups": [

Tasks/WindowsMachineFileCopyV1/task.loc.json

@@ -13,8 +13,8 @@
   "author": "Microsoft Corporation",
   "version": {
     "Major": 1,
-    "Minor": 228,
-    "Patch": 1
+    "Minor": 229,
+    "Patch": 0
   },
   "minimumAgentVersion": "1.104.0",
   "groups": [

Tasks/WindowsMachineFileCopyV2/task.json

@@ -13,8 +13,8 @@
     "author": "Microsoft Corporation",
     "version": {
         "Major": 2,
-        "Minor": 228,
-        "Patch": 1
+        "Minor": 229,
+        "Patch": 0
     },
     "releaseNotes": "What's new in Version 2.0: <br/>&nbsp;&nbsp;Proxy support is being added. <br/>&nbsp;&nbsp; Removed support of legacy DTL machines.",
     "minimumAgentVersion": "1.104.0",

Tasks/WindowsMachineFileCopyV2/task.loc.json

@@ -13,8 +13,8 @@
   "author": "Microsoft Corporation",
   "version": {
     "Major": 2,
-    "Minor": 228,
-    "Patch": 1
+    "Minor": 229,
+    "Patch": 0
   },
   "releaseNotes": "ms-resource:loc.releaseNotes",
   "minimumAgentVersion": "1.104.0",

_generated/AzureFileCopyV2.versionmap.txt

@@ -1,2 +1,2 @@
-Default|2.228.3
-Node16-225|2.228.2
+Default|2.229.1
+Node16-225|2.229.0

_generated/AzureFileCopyV2/task.json

@@ -13,8 +13,8 @@
   "author": "Microsoft Corporation",
   "version": {
     "Major": 2,
-    "Minor": 228,
-    "Patch": 3
+    "Minor": 229,
+    "Patch": 1
   },
   "demands": [
     "azureps"
@@ -370,7 +370,7 @@
     "ExpiredServicePrincipal": "Could not fetch access token for Azure. Verify if the Service Principal used is valid and not expired."
   },
   "_buildConfigMapping": {
-    "Default": "2.228.3",
-    "Node16-225": "2.228.2"
+    "Default": "2.229.1",
+    "Node16-225": "2.229.0"
   }
 }

_generated/AzureFileCopyV2/task.loc.json

@@ -13,8 +13,8 @@
   "author": "Microsoft Corporation",
   "version": {
     "Major": 2,
-    "Minor": 228,
-    "Patch": 3
+    "Minor": 229,
+    "Patch": 1
   },
   "demands": [
     "azureps"
@@ -370,7 +370,7 @@
     "ExpiredServicePrincipal": "ms-resource:loc.messages.ExpiredServicePrincipal"
   },
   "_buildConfigMapping": {
-    "Default": "2.228.3",
-    "Node16-225": "2.228.2"
+    "Default": "2.229.1",
+    "Node16-225": "2.229.0"
   }
 }