Parameter value is evaluated as an expression

[anthony-c-martin]

Repro

• main.bicepparam

  using 'main.bicep'
  
  param safeInput = '[subscription().id]'
  param vulnerableInput = {
    'in the value': '[subscription().id]'
    '[subscription().id]': 'in the key'
  }

• main.bicep

  param safeInput string
  param vulnerableInput object = {}
  
  var expansion = [for key in objectKeys(vulnerableInput): {
    name: key
    value: string(vulnerableInput[key])
  }]
  
  output safeOutput string = safeInput
  output vulnerableOutput object[] = expansion

Expected outcome

Both safeOutput and vulnerableOutput contain the string [subscription().id] unevaluated

Actual outcome

The vulnerableOutput output contains the evaluated result of [subscription().id]: