Security update for storageURL field of ApplicationPackage by wiboris · Pull Request #28957 · Azure/azure-powershell

wiboris · 2025-12-05T06:37:00Z

Description

Mandatory Checklist

Please choose the target release of Azure PowerShell. (⚠️Target release is a different concept from API readiness. Please click below links for details.)
- General release
- Public preview
- Private preview
- Engineering build
- No need for a release
Check this box to confirm: I have read the Submitting Changes section of CONTRIBUTING.md and reviewed the following information:

SHOULD update ChangeLog.md file(s) appropriately
- Update src/{{SERVICE}}/{{SERVICE}}/ChangeLog.md.
  - A snippet outlining the change(s) made in the PR should be written under the ## Upcoming Release header in the past tense.
- Should not change ChangeLog.md if no new release is required, such as fixing test case only.
SHOULD regenerate markdown help files if there is cmdlet API change. Instruction
SHOULD have proper test coverage for changes in pull request.
SHOULD NOT adjust version of module manually in pull request

azure-client-tools-bot-prd · 2025-12-05T06:37:03Z

Thanks for your contribution! The pull request validation has started. Please revisit this comment for updated status.

isra-fel · 2025-12-05T06:42:30Z

/azp run

azure-pipelines · 2025-12-05T06:42:46Z

Azure Pipelines successfully started running 3 pipeline(s).

Copilot

Pull request overview

This PR implements a security update to prevent exposing the storageUrl field (which contains SAS tokens) in the PSApplicationPackage object returned to users. The code refactors the application package upload workflow by separating the existence check from the storage URL retrieval, and comments out the StorageUrl assignment in the response converter.

Key changes:

Refactored GetStorageUrl method to remove the out parameter and split existence checking into a separate AppPackageExists method
Commented out StorageUrl assignment in ConvertGetApplicationPackageResponseToApplicationPackage to prevent exposing SAS tokens
Updated test to use -FilePath parameter instead of -ActivateOnly flag

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

File	Description
src/Batch/Batch/Models/BatchClient.ApplicationPackages.cs	Refactored application package upload logic; split existence check and storage URL retrieval; commented out StorageUrl field assignment
src/Batch/Batch.Test/ScenarioTests/BatchApplicationPackageTests.ps1	Changed test parameter from `-ActivateOnly` to `-FilePath` to match updated API
src/Batch/Batch.Test/SessionRecords/*.json	Updated test recordings with new timestamps, request IDs, and API version 4.0.0 reflecting the code changes

src/Batch/Batch/Models/BatchClient.ApplicationPackages.cs

src/Batch/Batch.Test/ScenarioTests/BatchApplicationPackageTests.ps1

src/Batch/Batch/Models/BatchClient.ApplicationPackages.cs

isra-fel · 2025-12-05T18:38:01Z

/azp run

azure-pipelines · 2025-12-05T18:38:19Z

Azure Pipelines successfully started running 3 pipeline(s).

Copilot

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated no new comments.

isra-fel · 2025-12-05T20:08:17Z

/azp run

wiboris · 2025-12-09T20:01:36Z

@wyunchi-ms updated changelog

isra-fel · 2025-12-09T20:08:50Z

/azp run

azure-pipelines · 2025-12-09T20:09:07Z

Azure Pipelines successfully started running 3 pipeline(s).

Copilot

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

src/Batch/Batch/ChangeLog.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 3 comments.

src/Batch/Batch/ChangeLog.md

src/Batch/Batch.Test/ScenarioTests/BatchApplicationPackageTests.ps1

isra-fel · 2025-12-10T18:38:35Z

/azp run

azure-pipelines · 2025-12-10T18:38:54Z

Azure Pipelines successfully started running 3 pipeline(s).

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

isra-fel · 2025-12-10T22:08:24Z

/azp run

azure-pipelines · 2025-12-10T22:08:42Z

Azure Pipelines successfully started running 3 pipeline(s).

Copilot

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

src/Batch/Batch/Models/BatchClient.ApplicationPackages.cs

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

src/Batch/Batch.Test/ScenarioTests/BatchApplicationPackageTests.ps1

isra-fel · 2025-12-10T23:08:17Z

/azp run

azure-pipelines · 2025-12-10T23:08:35Z

Azure Pipelines successfully started running 3 pipeline(s).

wiboris · 2025-12-11T18:10:07Z

@wyunchi-ms PR should be ready for review

wiboris added 2 commits December 4, 2025 22:05

changed the way we get the storageUrl from the get call to put call

101b1d9

changed test to upload file not just activate it

9ae7574

Copilot AI review requested due to automatic review settings December 5, 2025 06:37

wiboris requested review from DanielMicrosoft, NoriZC, Pan-Qi, VeryEarly, YanaXu, dolauli, isra-fel, notyashhh, vidai-msft and wyunchi-ms as code owners December 5, 2025 06:37

Copilot started reviewing on behalf of wiboris December 5, 2025 06:39 View session

Copilot finished reviewing on behalf of wiboris December 5, 2025 06:40

Copilot AI reviewed Dec 5, 2025

View reviewed changes

src/Batch/Batch/Models/BatchClient.ApplicationPackages.cs Outdated Show resolved Hide resolved

src/Batch/Batch/Models/BatchClient.ApplicationPackages.cs Outdated Show resolved Hide resolved

src/Batch/Batch/Models/BatchClient.ApplicationPackages.cs Outdated Show resolved Hide resolved

dpwatrous reviewed Dec 5, 2025

View reviewed changes

src/Batch/Batch.Test/ScenarioTests/BatchApplicationPackageTests.ps1 Outdated Show resolved Hide resolved

dpwatrous reviewed Dec 5, 2025

View reviewed changes

src/Batch/Batch/Models/BatchClient.ApplicationPackages.cs Outdated Show resolved Hide resolved

added test and responded to feedback

8073b1a

update to make test live only

f537a77

Copilot AI review requested due to automatic review settings December 5, 2025 19:47

Copilot started reviewing on behalf of wiboris December 5, 2025 19:49 View session

dpwatrous approved these changes Dec 5, 2025

View reviewed changes

Copilot AI reviewed Dec 5, 2025

View reviewed changes

Copilot AI review requested due to automatic review settings December 9, 2025 20:00

Copilot started reviewing on behalf of wiboris December 9, 2025 20:03 View session

Copilot AI reviewed Dec 9, 2025

View reviewed changes

src/Batch/Batch/ChangeLog.md Outdated Show resolved Hide resolved

src/Batch/Batch/ChangeLog.md Outdated Show resolved Hide resolved

Update src/Batch/Batch/ChangeLog.md

882c29a

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings December 10, 2025 18:18

Copilot started reviewing on behalf of wiboris December 10, 2025 18:20 View session

Copilot AI reviewed Dec 10, 2025

View reviewed changes

src/Batch/Batch/ChangeLog.md Outdated Show resolved Hide resolved

src/Batch/Batch/ChangeLog.md Outdated Show resolved Hide resolved

src/Batch/Batch.Test/ScenarioTests/BatchApplicationPackageTests.ps1 Outdated Show resolved Hide resolved

Update src/Batch/Batch/ChangeLog.md

cee0614

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings December 10, 2025 22:02

Copilot started reviewing on behalf of wiboris December 10, 2025 22:04 View session

Copilot AI reviewed Dec 10, 2025

View reviewed changes

src/Batch/Batch/Models/BatchClient.ApplicationPackages.cs Outdated Show resolved Hide resolved

src/Batch/Batch/Models/BatchClient.ApplicationPackages.cs Outdated Show resolved Hide resolved

wiboris and others added 2 commits December 10, 2025 14:50

copilot feedback

f3f0ab2

Update src/Batch/Batch/Models/BatchClient.ApplicationPackages.cs

b28e8d7

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings December 10, 2025 22:51

Update src/Batch/Batch/Models/BatchClient.ApplicationPackages.cs

4a42014

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot started reviewing on behalf of wiboris December 10, 2025 22:53 View session

Copilot AI reviewed Dec 10, 2025

View reviewed changes

src/Batch/Batch.Test/ScenarioTests/BatchApplicationPackageTests.ps1 Outdated Show resolved Hide resolved

Implementing coplilot suggesions

23870c5

wyunchi-ms approved these changes Dec 12, 2025

View reviewed changes

wyunchi-ms merged commit 6c09c36 into Azure:main Dec 12, 2025
12 checks passed

Conversation

wiboris commented Dec 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Mandatory Checklist

Uh oh!

azure-client-tools-bot-prd bot commented Dec 5, 2025

Uh oh!

isra-fel commented Dec 5, 2025

Uh oh!

azure-pipelines bot commented Dec 5, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

isra-fel commented Dec 5, 2025

Uh oh!

azure-pipelines bot commented Dec 5, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

isra-fel commented Dec 5, 2025

Uh oh!

wiboris commented Dec 9, 2025

Uh oh!

isra-fel commented Dec 9, 2025

Uh oh!

azure-pipelines bot commented Dec 9, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

isra-fel commented Dec 10, 2025

Uh oh!

azure-pipelines bot commented Dec 10, 2025

Uh oh!

isra-fel commented Dec 10, 2025

Uh oh!

azure-pipelines bot commented Dec 10, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

isra-fel commented Dec 10, 2025

Uh oh!

azure-pipelines bot commented Dec 10, 2025

Uh oh!

wiboris commented Dec 11, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

wiboris commented Dec 5, 2025 •

edited

Loading