From d0190f443dbbc483c8437bc4e4f7b690f98359f9 Mon Sep 17 00:00:00 2001
From: Oliver Kieselbach <oliver.kieselbach@outlook.com>
Date: Sun, 30 Aug 2026 12:37:36 +0200
Subject: [PATCH] =?UTF-8?q?fix(ci):=20build-agent=20workflow=5Fdispatch=20?=
 =?UTF-8?q?build=5Fnumber=20can=20no=20longer=20inject=20PowerShell=20?=
 =?UTF-8?q?=E2=80=94=20the=20input=20and=20the=20agent=20blob=20SAS=20reac?=
 =?UTF-8?q?h=20the=20version=20step=20only=20via=20env=20(BUILD=5FNUMBER?=
 =?UTF-8?q?=5FOVERRIDE,=20AGENT=5FSAS=5FTOKEN)=20instead=20of=20${{=20}}?=
 =?UTF-8?q?=20in=20the=20script=20body,=20and=20the=20override=20is=20vali?=
 =?UTF-8?q?dated=20against=20^\d+$=20before=20the=20[int]=20cast=20and=20t?=
 =?UTF-8?q?he=20counter-blob=20CAS;=20counter=20semantics=20unchanged?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/build-agent.yml | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build-agent.yml b/.github/workflows/build-agent.yml
index 3d63c8a3..c9165ed6 100644
--- a/.github/workflows/build-agent.yml
+++ b/.github/workflows/build-agent.yml
@@ -76,12 +76,23 @@ jobs:
       - name: Reserve build number (counter blob CAS)
         id: version
         shell: pwsh
+        # Input and secret reach the script only as environment variables, never as script
+        # text: ${{ }} is substituted before pwsh parses the block, so a crafted
+        # build_number could otherwise break out of the quotes and run arbitrary code.
+        env:
+          BUILD_NUMBER_OVERRIDE: ${{ inputs.build_number }}
+          AGENT_SAS_TOKEN: ${{ secrets.AZURE_BLOB_AGENT_SAS_TOKEN }}
         run: |
           $override = 0
-          if ('${{ inputs.build_number }}' -ne '') { $override = [int]'${{ inputs.build_number }}' }
+          if ($env:BUILD_NUMBER_OVERRIDE -ne '') {
+            if ($env:BUILD_NUMBER_OVERRIDE -notmatch '^\d+$') {
+              throw "build_number must be a positive integer, got '$($env:BUILD_NUMBER_OVERRIDE)'"
+            }
+            $override = [int]$env:BUILD_NUMBER_OVERRIDE
+          }
 
           $counterUrl = "https://autopilotmonitoreu.blob.core.windows.net/agent/buildcounter-v$($env:LINE_MAJOR).txt"
-          $buildNumber = & ./.github/scripts/Request-BuildNumber.ps1 -CounterUrl $counterUrl -SasToken '${{ secrets.AZURE_BLOB_AGENT_SAS_TOKEN }}' -Override $override
+          $buildNumber = & ./.github/scripts/Request-BuildNumber.ps1 -CounterUrl $counterUrl -SasToken $env:AGENT_SAS_TOKEN -Override $override
 
           $csproj = Get-Content $env:CSPROJ_PATH -Raw
           if ($csproj -match '<VersionPrefix>(\d+\.\d+)</VersionPrefix>') {