| name | extension-security-review |
| description | Use when doing a security review of the Black Duck Security Scan ADO extension. Covers SAST-level checks specific to this codebase — secret/credential logging, command injection, path traversal, TLS bypass, insecure HTTP clients, token leakage in files, proxy credential exposure, input injection into JSON payloads, and ADO pipeline variable security. Produces findings with file:line citations and remediation steps. |
Extension Security Review
Security review grounded in this codebase's architecture. Always read changed files before producing findings. Never flag theoretical risks when the code pattern already mitigates them (e.g. taskLib.exec with array args is not shell injection).
How to Use
When the user says "security review", "check for vulnerabilities", "SAST review", or invokes this skill, do the following:
- Read all changed files (or files named by the user)
- Run all checklists below against the code
- Report findings as:
file:line — [SEVERITY] — vulnerability — remediation
- Severities:
CRITICAL (exploitable now), HIGH (likely exploitable), MEDIUM (exploitable under conditions), LOW (defense-in-depth / hardening)
Checklist 1 — Secret and Credential Logging
Context: Credentials flow through input.ts exports (POLARIS_ACCESS_TOKEN, BLACKDUCKSCA_TOKEN, COVERITY_USER_PASSWORD, SRM_API_KEY, AZURE_TOKEN). These are written into JSON input files and passed to Bridge CLI. Proxy URLs can contain embedded passwords.
Checks:
Remediation pattern:
taskLib.debug(`config: ${JSON.stringify(polData)}`);
taskLib.debug(`Generated input file at: ${stateFilePath}`);
Checklist 2 — Credential Exposure in Temporary Files
Context: tools-parameter.ts writes full product config (including access tokens, passwords) to temp files: polaris_input.json, bd_input.json, coverity_input.json, srm_input.json. These live in Agent.TempDirectory during pipeline execution.
Checks:
HIGH risk: if Agent.TempDirectory is shared across pipeline steps, another step could read polaris_input.json and exfiltrate the access token before cleanup.
Checklist 3 — Command Injection
Context: executeBridgeCliCommand() in bridge-cli.ts calls taskLib.exec(executableBridgeCliPath, command, { cwd: workspace }). taskLib.exec with a string command arg passes through shell parsing on some platforms. The command string is built by concatenating --stage and --input flags in tools-parameter.ts.
Checks:
Note: taskLib.exec(path, string) on Windows spawns cmd.exe /D /E:ON /V:OFF /S /C "..." — a quoted --input path containing &, |, ^ could break out. Ensure input file paths use only alphanumeric + path separators.
Checklist 4 — Path Traversal
Context: File paths are constructed in utility.ts, tools-parameter.ts, and ssl-utils.ts using path.join() and path.resolve(). User-controlled inputs include BRIDGECLI_INSTALL_DIRECTORY, NETWORK_SSL_CERT_FILE, COVERITY_INSTALL_DIRECTORY, SARIF file path inputs.
Checks:
Remediation pattern:
const resolved = path.resolve(inputs.BRIDGECLI_INSTALL_DIRECTORY);
const allowed = path.resolve(getTempDir());
if (!resolved.startsWith(allowed + path.sep) && resolved !== allowed) {
throw new Error("Path traversal detected in install directory");
}
Checklist 5 — TLS / SSL Security
Context: NETWORK_SSL_TRUST_ALL disables certificate verification. NETWORK_SSL_CERT_FILE loads a custom CA. Both flow through ssl-utils.ts into createSSLConfiguredHttpClient().
Checks:
Checklist 6 — Token Handling and Authorization Headers
Context: azure-service-client.ts uses Basic Auth with Base64-encoded ADO token. Token comes from AZURE_TOKEN input, which should be an ADO secret variable.
Checks:
Checklist 7 — Input Injection into JSON Payloads
Context: User inputs (product URLs, assessment types, branch names, project names) are serialized into *_input.json files via JSON.stringify(). If input is not sanitized, malicious values could alter the JSON structure or inject unexpected fields consumed by Bridge CLI.
Checks:
Checklist 8 — ADO Pipeline Variable Security
Context: ##vso[task.setvariable variable=status;isoutput=true] is used in main.ts to emit the exit code as a pipeline variable. ADO variables without issecret=true are visible in pipeline logs.
Checks:
Checklist 9 — Dependency and Supply Chain Security
Checks:
Checklist 10 — Error Message Information Disclosure
Context: Error messages thrown in validator.ts, bridge-cli.ts, tools-parameter.ts propagate to main.ts catch block and are surfaced in taskLib.error() and taskLib.setResult(), which appear in ADO pipeline logs visible to anyone with pipeline read access.
Checks:
Quick Severity Reference
| Tag | Meaning |
|---|
CRITICAL | Direct credential exfiltration or code execution possible |
HIGH | Credential leak to logs or files, TLS bypass enabled by default, path traversal to arbitrary files |
MEDIUM | Conditional exposure (requires specific pipeline config), information disclosure in logs |
LOW | Defense-in-depth hardening; not exploitable on its own but reduces attack surface |
Known Safe Patterns (Do Not Flag)
taskLib.exec(exePath, commandString) — azure-pipelines-task-lib escapes args; not raw shell execBuffer.from(token, "utf8").toString("base64") — correct Basic Auth encoding; not a vulnerabilitypath.join(tempDir, filename) for generated JSON files — temp dir is agent-controlledJSON.stringify(typedObject) where object is constructed from typed model — not vulnerable to prototype pollution injectioninputs.NETWORK_SSL_TRUST_ALL defaulting to false — correct secure default
