Add parameter array to prevent command injection

Tasks/AzureContainerAppsV1/src/ContainerRegistryHelper.ts

@@ -13,9 +13,11 @@ export class ContainerRegistryHelper {
      public loginAcrWithUsernamePassword(acrName: string, acrUsername: string, acrPassword: string) {
         tl.debug(`Attempting to log in to ACR instance "${acrName}" with username and password credentials`);
         try {
-            child.execSync(
-                `docker login --password-stdin --username ${acrUsername} ${acrName}.azurecr.io`,
-                { input: acrPassword });
+            child.execFileSync('docker', [
+                'login', '--password-stdin',
+                '--username', acrUsername,
+                `${acrName}.azurecr.io`
+            ], { input: acrPassword });
         } catch (err) {
             tl.error(tl.loc('AcrUsernamePasswordAuthFailed', acrName));
             throw err;
@@ -30,8 +32,22 @@ export class ContainerRegistryHelper {
      public async loginAcrWithAccessTokenAsync(acrName: string) {
         tl.debug(`Attempting to log in to ACR instance "${acrName}" with access token`);
         try {
-            const command: string = `CA_ADO_TASK_ACR_ACCESS_TOKEN=$(az acr login --name ${acrName} --output json --expose-token --only-show-errors | jq -r '.accessToken'); docker login ${acrName}.azurecr.io -u 00000000-0000-0000-0000-000000000000 -p $CA_ADO_TASK_ACR_ACCESS_TOKEN > /dev/null 2>&1`;
-            await new CommandHelper().execCommandAsync(command);
+            const tokenJson = child.execFileSync('az', [
+                'acr', 'login',
+                '--name', acrName,
+                '--output', 'json',
+                '--expose-token',
+                '--only-show-errors'
+            ], { encoding: 'utf8' });
+
+            const accessToken = JSON.parse(tokenJson).accessToken;
+
+            child.execFileSync('docker', [
+                'login',
+                `${acrName}.azurecr.io`,
+                '-u', '00000000-0000-0000-0000-000000000000',
+                '-p', accessToken
+            ], { stdio: 'pipe' });
         } catch (err) {
             tl.error(tl.loc('AcrAccessTokenAuthFailed', acrName));
             throw err;

Tasks/AzureContainerAppsV1/task.json

@@ -18,7 +18,7 @@
   ],
   "version": {
     "Major": 1,
-    "Minor": 270,
+    "Minor": 271,
     "Patch": 0
   },
   "minimumAgentVersion": "2.144.0",

Tasks/AzureContainerAppsV1/task.loc.json

@@ -18,7 +18,7 @@
   ],
   "version": {
     "Major": 1,
-    "Minor": 270,
+    "Minor": 271,
     "Patch": 0
   },
   "minimumAgentVersion": "2.144.0",

Tasks/AzureResourceManagerTemplateDeploymentV3/operations/Utils.ts

@@ -493,16 +493,16 @@ class Utils {
         var finalPathExtension: string = ".json" 
 
         if(filePathExtension === 'bicep'){
-            const result: IExecSyncResult = tl.execSync("az", `bicep build --file "${filePath}"`);
+            const result: IExecSyncResult = tl.execSync("az", ["bicep", "build", "--file", filePath]);
             if(result && result.code !== 0){
                 throw new Error(tl.loc("BicepBuildFailed", result.stderr));
             }
         }
         else{
             finalPathExtension = ".parameters.json"
 
-            //Using --outfile to avoid overwriting primary bicep file in the case bicep and param file have the the same file name.
-            const result: IExecSyncResult = tl.execSync("az", `bicep build-params --file "${filePath}" --outfile "${path.join(fileDir, fileName + finalPathExtension)}"`);
+            const outfile = path.join(fileDir, fileName + finalPathExtension);
+            const result: IExecSyncResult = tl.execSync("az", ["bicep", "build-params", "--file", filePath, "--outfile", outfile]);
             if(result && result.code !== 0){
                 throw new Error(tl.loc("BicepParamBuildFailed", result.stderr));
             } 

Tasks/AzureResourceManagerTemplateDeploymentV3/task.json

@@ -14,7 +14,7 @@
   "author": "Microsoft Corporation",
   "version": {
     "Major": 3,
-    "Minor": 270,
+    "Minor": 271,
     "Patch": 0
   },
   "demands": [],

Tasks/AzureResourceManagerTemplateDeploymentV3/task.loc.json

@@ -14,7 +14,7 @@
   "author": "Microsoft Corporation",
   "version": {
     "Major": 3,
-    "Minor": 270,
+    "Minor": 271,
     "Patch": 0
   },
   "demands": [],

Tasks/JavaToolInstallerV0/FileExtractor/JavaFilesExtractor.ts

@@ -148,9 +148,11 @@ export class JavaFilesExtractor {
                 // Unpack the pack file synchronously
                 const p = path.parse(fsPath);
                 const toolName = process.platform.match(/^win/i) ? 'unpack200.exe' : 'unpack200'; 
-                const args = process.platform.match(/^win/i) ? '-r -v -l ""' : '';
                 const name = path.join(p.dir, p.name);
-                taskLib.execSync(path.join(javaBinPath, toolName), `${args} "${name}.pack" "${name}.jar"`); 
+                const execArgs: string[] = process.platform.match(/^win/i)
+                    ? ['-r', '-v', '-l', '', `${name}.pack`, `${name}.jar`]
+                    : [`${name}.pack`, `${name}.jar`];
+                taskLib.execSync(path.join(javaBinPath, toolName), execArgs); 
             }
         }    
     }

Tasks/JavaToolInstallerV0/task.json

@@ -13,7 +13,7 @@
   "author": "Microsoft Corporation",
   "version": {
     "Major": 0,
-    "Minor": 270,
+    "Minor": 271,
     "Patch": 0
   },
   "satisfies": [

Tasks/JavaToolInstallerV0/task.loc.json

@@ -13,7 +13,7 @@
   "author": "Microsoft Corporation",
   "version": {
     "Major": 0,
-    "Minor": 270,
+    "Minor": 271,
     "Patch": 0
   },
   "satisfies": [