Fix critical KQL injection vulnerabilities and runtime errors in WACOA collector

[Copilot]

The WACOA collector script had multiple KQL injection vulnerabilities allowing malicious JSON scope files or YAML definitions to execute arbitrary queries against Azure Resource Graph. Additionally, users encountered runtime errors when settings.json was missing the scriptVersion field.

Security Fixes

KQL Injection Prevention

• Escape single quotes in subscription IDs, resource group names, and resource types before interpolating into KQL queries
• Add validation functions: Test-SubscriptionId (GUID format), Test-ResourceGroupName (Azure naming rules), Test-ResourceType (Provider.Service/type format)
• Reject invalid inputs at parse time rather than at query execution

# Before: Direct interpolation allowed injection
$scopeConditions += "(SubAccountId == '$($scope.SubscriptionId)')"

# After: Escaped to prevent injection
$escapedSubId = $scope.SubscriptionId -replace "'", "''"
$scopeConditions += "(SubAccountId == '$escapedSubId')"

Archive Extraction Path Traversal Protection

• Extract to staging directory first
• Validate no entries contain ../ or ..\ patterns
• Reject malicious archives before copying to final destination

Bug Fixes

Empty CurrentVersion Parameter

• Handle missing scriptVersion in settings.json with automatic default
• Add [AllowEmptyString()] attribute and null check in Check-ScriptVersion
• Auto-repair incomplete settings files

CSV Header Detection

• Replace hardcoded Skip 11 with dynamic header line detection
• Warn if no data found after parsing

User Input Normalization

• Apply .Trim().ToLower() to all Yes/No prompts for consistent behavior

Operational Improvements

• Add security warnings when downloading scripts from remote URLs
• Change logging ErrorAction from SilentlyContinue to Continue to surface write failures
• Add file size validation (minimum 100 bytes) for downloaded scripts

Original prompt

Review the WARA collector script

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.