Update installation script URL for Azure CLI on Linux#5795
Update installation script URL for Azure CLI on Linux#5795Travisivart wants to merge 1 commit intoMicrosoftDocs:mainfrom
Conversation
We absolutely should not be using a vanity url for piping an install script to sudo bash. This opens up an attack vector in which anyone with access to update the vanity url could maliciously inject code into the users system. These vanity urls do not go through any sort of change management nor approvals. Any single individual with ownership of the url could make a change to point the url to a custom or private script which could then install malware or execute arbitrary code on the user's system. We should update the documentation to point to the actual script, or use a method which requires more approval or change management to modify a script which we instruct users to run.
PoliCheck Scan ReportThe following report lists PoliCheck issues in PR files. Before you merge the PR, you must fix all severity-1 and severity-2 issues. The AI Review Details column lists suggestions for either removing or replacing the terms. If you find a false positive result, mention it in a PR comment and include this text: #policheck-false-positive. This feedback helps reduce false positives in future scans. ✅ No issues foundMore information about PoliCheckInformation: PoliCheck | Severity Guidance | Term |
|
Learn Build status updates of commit 1ade4ca: 💡 Validation status: suggestions
docs-ref-conceptual/Latest-version/includes/cli-install-linux-apt.md
For more details, please refer to the build report. Note: Your PR may contain errors or warnings or suggestions unrelated to the files you changed. This happens when external dependencies like GitHub alias, Microsoft alias, cross repo links are updated. Please use these instructions to resolve them. |
|
@Travisivart, Thanks for raising this and for the detailed explanation. Vanity URLs are used this way across multiple Azure CLI docs, so this goes beyond this single page. I’ve reached out to the Azure CLI PMs and engineering team for feedback and will follow up once I hear back. |
2 participants
We absolutely should not be using a vanity url for piping an install script to sudo bash. This opens up an attack vector in which anyone with access to update the vanity url could maliciously inject code into the users system. These vanity urls do not go through any sort of change management nor approvals. Any single individual with ownership of the url could make a change to point the url to a custom or private script which could then install malware or execute arbitrary code on the user's system.
We should update the documentation to point to the actual script, or use a method which requires more approval or change management to modify a script which we instruct users to run.