Security hotspot on azure-pipelines.yml (azurepipelines:S7637)

SonarQube Cloud
,
1
  • ALM Azure DevOps Services
  • CI system used: Azure DevOps Pipelines
  • Scanner command used when applicable (private details masked) SonarCloudPrepare@4.2.0
  • Languages of the repository
  • Error observed (wrap logs/code around with triple quotes ``` for proper formatting)
    For SonarCloudPrepare and VisualStudioTestPlatformInstaller a specific version is demanded. You don’t trust your own pipeline task :wink:
  • Steps to reproduce
    In the pipeline, following tasks are marked as Securtity Hotspots
    - task: SonarCloudPrepare@4
      # Use complete version number for the task instead of "4".
       displayName: 'Prepare the SonarQube Cloud analysis'
             condition: ne(variables['Build.Reason'], 'Schedule')
             inputs:
               SonarCloud: $(SonarQubeServiceConnection)
               organization: $(SonarQubeOrganization)

    - task: VisualStudioTestPlatformInstaller@1
      # Use complete version number for the task instead of "1".
            inputs:
              packageFeedSelector: 'nugetOrg'
              versionSelector: 'specificVersion'
              testPlatformVersion: '17.9.0'
1 Like