azure-pipelines-task-lib 5.2.3 → 5.2.4

package/internal.js

@@ -919,13 +919,15 @@ exports._exposeCertSettings = _exposeCertSettings;
 // downstream vsts-node-api will retrieve the secret later
 function _exposeTaskLibSecret(keyFile, secret) {
     if (secret) {
-        var encryptKey = crypto.randomBytes(256);
-        var cipher = crypto.createCipher("aes-256-ctr", encryptKey);
+        var encryptKey = crypto.randomBytes(32);
+        var iv = crypto.randomBytes(16);
+        var cipher = crypto.createCipheriv("aes-256-ctr", encryptKey, iv);
         var encryptedContent = cipher.update(secret, "utf8", "hex"); // CodeQL [SM01511] agent need to retrieve password later to connect to proxy server
         encryptedContent += cipher.final("hex");
         var storageFile = path.join(_getVariable('Agent.TempDirectory') || _getVariable("agent.workFolder") || process.cwd(), keyFile);
-        fs.writeFileSync(storageFile, encryptKey.toString('base64'), { encoding: 'utf8' });
-        return new Buffer(storageFile).toString('base64') + ':' + new Buffer(encryptedContent).toString('base64');
+        var keyAndIv = encryptKey.toString('base64') + ':' + iv.toString('base64');
+        fs.writeFileSync(storageFile, keyAndIv, { encoding: 'utf8' });
+        return Buffer.from(storageFile).toString('base64') + ':' + Buffer.from(encryptedContent).toString('base64');
     }
 }
 function isSigPipeError(e) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "azure-pipelines-task-lib",
-  "version": "5.2.3",
+  "version": "5.2.4",
   "description": "Azure Pipelines Task SDK",
   "main": "./task.js",
   "typings": "./task.d.ts",