Bug 2030875 - azure-pipelines-task-lib repo logs passwords in plain text

src/Agent.Worker/TaskCommandExtension.cs

@@ -36,6 +36,24 @@ public TaskCommandExtension()
         }
     }
 
+    public static class TaskCommandHelper
+    {
+        public static void AddSecret(IExecutionContext context, string value, string origin)
+        {
+            if (!string.IsNullOrEmpty(value))
+            {
+                context.GetHostContext().SecretMasker.AddValue(value, origin);
+
+                // if DECODE_PERCENTS = false then we need to add decoded value as a secret as well to prevent its exposion in logs
+                var unescapePercents = AgentKnobs.DecodePercents.GetValue(context).AsBoolean();
+                if (!unescapePercents)
+                {
+                    context.GetHostContext().SecretMasker.AddValue(CommandStringConvertor.Unescape(value, true), origin);
+                }
+            }
+        }
+    }
+
     [CommandRestriction(AllowedInRestrictedMode = true)]
     public sealed class TaskDetailCommand : IWorkerCommand
     {
@@ -536,11 +554,7 @@ public void Execute(IExecutionContext context, Command command)
             ArgUtil.NotNull(context, nameof(context));
             ArgUtil.NotNull(command, nameof(command));
 
-            var data = command.Data;
-            if (!string.IsNullOrEmpty(data))
-            {
-                context.GetHostContext().SecretMasker.AddValue(data, WellKnownSecretAliases.TaskSetSecretCommand);
-            }
+            TaskCommandHelper.AddSecret(context, command.Data, WellKnownSecretAliases.TaskSetSecretCommand);
         }
     }
 
@@ -611,7 +625,7 @@ public void Execute(IExecutionContext context, Command command)
 
                 var unescapePercents = AgentKnobs.DecodePercents.GetValue(context).AsBoolean();
                 var commandEscapeData = CommandStringConvertor.Escape(command.Data, unescapePercents);
-                context.GetHostContext().SecretMasker.AddValue(commandEscapeData, WellKnownSecretAliases.TaskSetVariableCommand);
+                TaskCommandHelper.AddSecret(context, commandEscapeData, WellKnownSecretAliases.TaskSetVariableCommand);
             }
 
             var checker = context.GetHostContext().GetService<ITaskRestrictionsChecker>();
@@ -727,7 +741,7 @@ public void Execute(IExecutionContext context, Command command)
             // Mask auth parameter data upfront to avoid accidental secret exposure by invalid endpoint/key/data
             if (String.Equals(field, "authParameter", StringComparison.OrdinalIgnoreCase))
             {
-                context.GetHostContext().SecretMasker.AddValue(data, WellKnownSecretAliases.TaskSetEndpointCommandAuthParameter);
+                TaskCommandHelper.AddSecret(context, data, WellKnownSecretAliases.TaskSetEndpointCommandAuthParameter);
             }
 
             String endpointIdInput;

src/Agent.Worker/WorkerCommandManager.cs

@@ -9,6 +9,7 @@
 using System.Linq;
 using System.Net.Sockets;
 using System.Collections.Generic;
+using Agent.Sdk;
 
 namespace Microsoft.VisualStudio.Services.Agent.Worker
 {
@@ -128,7 +129,7 @@ public bool TryProcessCommand(IExecutionContext context, string input)
                         if (!(string.Equals(command.Area, "task", StringComparison.OrdinalIgnoreCase) &&
                               string.Equals(command.Event, "debug", StringComparison.OrdinalIgnoreCase)))
                         {
-                            context.Debug($"Processed: {input}");
+                            context.Debug($"Processed: {CommandStringConvertor.Unescape(input, unescapePercents)}");
                         }
                     }
                 }

src/Test/L0/Worker/TaskCommandExtensionL0.cs

@@ -4,6 +4,7 @@
 using System;
 using System.Collections.Generic;
 using System.Runtime.CompilerServices;
+using Agent.Sdk;
 using Microsoft.TeamFoundation.DistributedTask.WebApi;
 using Microsoft.VisualStudio.Services.Agent.Worker;
 using Moq;
@@ -200,6 +201,7 @@ private TestHostContext SetupMocks([CallerMemberName] string name = "")
 
             _ec.Setup(x => x.Endpoints).Returns(new List<ServiceEndpoint> { _endpoint });
             _ec.Setup(x => x.GetHostContext()).Returns(_hc);
+            _ec.Setup(x => x.GetScopedEnvironment()).Returns(new SystemEnvironment());
 
             return _hc;
         }