Fix for bug MSRC97007

[rajmishra1997]

Fix for issue https://portal.microsofticm.com/imp/v5/incidents/details/31000000353897/summary , which describes a vulnerability in Azure Pipelines where malicious input can be injected through Git metadata, not necessarily through built-in pipeline variables.

For example, in the following YAML pipeline code:
$authorEmail = git log -1 --pretty=format:"%ae" Write-Host "Email address of the author is $authorEmail"

Git user email could be updated such as :
git config user.email "##vso[task.setvariable variable=downloadUrl]https://www.evil.com"
This would inject a VSO command into the pipeline runtime and update the Url variable.

As fix:
The code has been updated to include a condition that checks whether the Git author name, email address, or commit message contains any VSO commands, preventing unintended command execution. Also built-in variables 'Build.RequestedForEmail, Release.ReleaseDeploymentRequestedForEmail, Release.ReleaseRequestedForEmail' are included as 'VariablesVulnerableToExecution'

Explain the context or motivation behind this PR. Include links to any related Azure DevOps Work Items or GitHub issues. Fixes AB#2277633
📌 How to link to ADO Work Items

Risk Assessment (Low / Medium / High) : Low

Assess the risk level and justify your assessment. For example: code path sensitivity, usage scope, or backward compatibility concerns.

---

Unit Tests Added or Updated (Yes / No) : Yes

Indicate whether unit tests were added or modified to reflect the changes.

---

Additional Testing Performed : Changes tested locally

List manual or automated tests performed beyond unit tests (e.g., integration, scenario, regression).

[rajmishra1997]

/azp run

[azure-pipelines]

Supported commands

• help:
• Get descriptions, examples and documentation about supported commands
• Example: help "command_name"
• list:
• List all pipelines for this repository using a comment.
• Example: "list"
• run:
• Run all pipelines or specific pipelines for this repository using a comment. Use this command by itself to trigger all related pipelines, or specify specific pipelines to run.
• Example: "run" or "run pipeline_name, pipeline_name, pipeline_name"
• where:
• Report back the Azure DevOps orgs that are related to this repository and org
• Example: "where"

See additional documentation.

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[tarunramsinghani]

please make sure there are no unneccesary failures

[rajmishra1997]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).