fix(safeoutputs): sanitize ADO-sourced title and tags in prefix-guard error messages to prevent VSO command injection

[Copilot]

check_prefix_guards() embedded raw ADO-fetched System.Title and System.Tags values directly into ExecutionResult::failure() messages, which Stage 3 prints to stdout via println!. An attacker with ADO work item write access could craft a title/tag containing ##vso[...] pipeline commands to exfiltrate secrets, manipulate PATH, or smuggle artifacts.

Changes

• src/safeoutputs/update_work_item.rs: Apply sanitize_text() to ADO-fetched current_title and raw_tags before embedding in failure messages, neutralizing ##vso[ and ##[ sequences via neutralize_pipeline_commands()

// Before — raw ADO data reaches println! in Stage 3
return Ok(Some(ExecutionResult::failure(format!(
    "Work item #{id} title '{current_title}' does not start with..."
))));

// After — sanitized before output
let safe_title = sanitize_text(current_title);
return Ok(Some(ExecutionResult::failure(format!(
    "Work item #{id} title '{safe_title}' does not start with..."
))));

The SanitizeContent machinery already covers agent-provided fields (Stage 1 proposals); this closes the gap for ADO-sourced values fetched during Stage 3 validation.

Test plan

cargo test — all 340 safeoutputs tests pass.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• spsprodweu4.vssps.visualstudio.com
  • Triggering command: /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/ado_aw-654342efa6a15a60 /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/ado_aw-654342efa6a15a60 safeoutputs /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/mcp_http_tests-993a492206374918.16ab0b0olzrzr12kc57t5p1sr.1rw1392.rcgu.o /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/mcp_http_tests-993a492206374918.18xon91a2tv7lb12ymxhz4oaq.1rw1392.rcgu.o /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/mcp_http_tests-993a492206374918.1b3adzvekogy27t80lo1vxa4n.1rw1392.rcgu.o /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/mcp_http_tests-993a492206374918.1dt6tpv49dvqzvamk1ydakmu9.1rw1392.rcgu.o 8atel5l3op9z678oy5n.0qyc0c3.rcgu.o xzlc2dor4yntxwkm72z.0qyc0c3.rcgu.o xx36woxfl7gremo3ua9.0qyc0c3.rcgu.o w1y48h6mdh3h0m7qug0.0qyc0c3.rcgu.o coq2x4gd01bhkez88r1.0qyc0c3.rcgu.o dn9sguvfbwe9cthd0xu.0qyc0c3.rcgu.o qzxtm92rf11xgqb3iuy.0qyc0c3.rcgu.o p9ztercifwqae6vafgh.0qyc0c3.rcgu.o 5vvi9jr1qp5uuejei6i.0qyc0c3.rcgu.o hbl8ezlwmnw18avaft9.0qyc0c3.rcgu.o agmhocz2m8kzdzyzkth.0qyc0c3.rcgu.o hhpdlarihnqyg2cwmzv.0qyc0c3.rcgu.o 0f4lf5blsqph4xihpue.0qyc0c3.rcgu.o 8h7frqepcz35kh3tahg.0qyc0c3.rcgu.o (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)