azure-pipelines-task-lib 5.280.0 → 5.280.1

package/externaloutput.d.ts

@@ -0,0 +1,72 @@
+/// <reference types="node" />
+/// <reference types="node" />
+/// <reference types="node" />
+import stream = require('stream');
+/** Commands allowed by default once VSO commands are enabled for a path. */
+export declare const defaultAllowedVsoCommands: readonly string[];
+/**
+ * Where the external output originates. Used for documentation and telemetry only; it does
+ * NOT select an automatic allowlist. A task must explicitly enable VSO commands when needed.
+ */
+export type ExternalOutputSource = 'remote' | 'childProcess' | 'repository';
+export interface ExternalOutputOptions {
+    /** Origin of the output. Documentation/telemetry only. */
+    source: ExternalOutputSource;
+    /**
+     * When false or omitted, every "##vso[" marker is blocked. When true, markers whose
+     * command name is in the effective allowlist pass through unchanged.
+     */
+    enableVsoCommands?: boolean;
+    /**
+     * The allowlist of "area.event" command names to permit when enableVsoCommands is true.
+     * Replaces (does not extend) the default list. An explicit empty array allows nothing.
+     * Has no effect when enableVsoCommands is false.
+     */
+    allowedVsoCommands?: readonly string[];
+    /** Destination for filtered output. Defaults to process.stdout. */
+    destination?: NodeJS.WritableStream;
+}
+/**
+ * Stateful, byte-level marker filter. Feed bytes with push() and finish with flush().
+ * Retains only the minimal bytes needed to resolve a marker that straddles a chunk
+ * boundary, so memory stays bounded regardless of input size.
+ */
+export declare class MarkerFilter {
+    private readonly enabled;
+    private readonly allowed;
+    private pending;
+    constructor(enabled: boolean, allowed: Set<string>);
+    push(chunk: Buffer): Buffer;
+    flush(): Buffer;
+}
+/**
+ * A Transform stream that neutralizes VSO command markers in external output. Pipe untrusted
+ * output into it; it writes filtered bytes to its readable side (and, via
+ * createExternalOutputStream, on to the destination).
+ */
+export declare class ExternalOutputStream extends stream.Transform {
+    private readonly markerFilter;
+    constructor(options: ExternalOutputOptions);
+    _transform(chunk: any, _encoding: string, callback: (error?: Error | null) => void): void;
+    _flush(callback: (error?: Error | null) => void): void;
+}
+/**
+ * Creates a filtering stream for external output and pipes it to the destination
+ * (default process.stdout). Pipe untrusted output into the returned stream, e.g.
+ * `jenkinsResponse.pipe(tl.createExternalOutputStream({ source: 'remote' }))`.
+ */
+export declare function createExternalOutputStream(options: ExternalOutputOptions): ExternalOutputStream;
+/**
+ * Filters a complete piece of external output and writes it to the destination
+ * (default process.stdout). Each call is self-contained; for output that arrives in
+ * chunks that may split a marker, use createExternalOutputStream instead.
+ */
+export declare function writeExternalOutput(data: string | Buffer, options: ExternalOutputOptions): void;
+/** Filters one complete value and returns its bytes without writing them. */
+export declare function filterExternalOutput(data: string | Buffer, options: ExternalOutputOptions): Buffer;
+export interface FilteredWriter {
+    write(data: string | Buffer): void;
+    end(): void;
+}
+/** Creates a stateful writer that filters markers split across writes. */
+export declare function createFilteredWriter(options: ExternalOutputOptions, destination: NodeJS.WritableStream): FilteredWriter;

package/externaloutput.js

@@ -0,0 +1,297 @@
+"use strict";
+// Copyright (c) Microsoft. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+var __extends = (this && this.__extends) || (function () {
+    var extendStatics = function (d, b) {
+        extendStatics = Object.setPrototypeOf ||
+            ({ __proto__: [] } instanceof Array && function (d, b) { d.__proto__ = b; }) ||
+            function (d, b) { for (var p in b) if (Object.prototype.hasOwnProperty.call(b, p)) d[p] = b[p]; };
+        return extendStatics(d, b);
+    };
+    return function (d, b) {
+        if (typeof b !== "function" && b !== null)
+            throw new TypeError("Class extends value " + String(b) + " is not a constructor or null");
+        extendStatics(d, b);
+        function __() { this.constructor = d; }
+        d.prototype = b === null ? Object.create(b) : (__.prototype = b.prototype, new __());
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createFilteredWriter = exports.filterExternalOutput = exports.writeExternalOutput = exports.createExternalOutputStream = exports.ExternalOutputStream = exports.MarkerFilter = exports.defaultAllowedVsoCommands = void 0;
+var stream = require("stream");
+//
+// External output filtering.
+//
+// Azure Pipelines treats a task's stdout both as log text and as a command channel:
+// a line containing the marker "##vso[area.event ...]data" is parsed and executed by the
+// agent. When a task echoes output that originates from an untrusted source (a remote
+// server, a child process, a repository filename, compiler/test output, ...), that source
+// can smuggle a "##vso[" marker and make the agent run a command on its behalf.
+//
+// This module neutralizes markers in such external output before it reaches the agent's
+// command parser. By default every marker is blocked (rewritten "##vso[" -> "##_vso[").
+// A task may opt a compatibility-sensitive path into a small, explicit allowlist of
+// command names; unknown, malformed, or future commands stay blocked.
+//
+// The filter works on raw bytes (Buffer) so it never corrupts invalid UTF-8, binary
+// output, or multibyte characters split across chunk boundaries. It matches the marker
+// byte-for-byte, mirroring the agent's Ordinal comparison, so the two agree exactly on
+// what a marker is.
+//
+/** The exact marker bytes the agent recognizes as the start of a command: "##vso[". */
+var MARKER = Buffer.from('##vso[', 'ascii');
+/** Neutralized form written in place of a blocked marker: "##_vso[". */
+var NEUTRALIZED = Buffer.from('##_vso[', 'ascii');
+var EMPTY = Buffer.alloc(0);
+var SPACE = 0x20;
+var RBRACKET = 0x5D; // ]
+var CR = 0x0D;
+var LF = 0x0A;
+// Maximum command-name bytes retained while waiting for a terminator.
+var MAX_HEADER = 256;
+/** Commands allowed by default once VSO commands are enabled for a path. */
+exports.defaultAllowedVsoCommands = Object.freeze(['task.debug', 'task.setprogress']);
+function resolveAllowed(options) {
+    if (!options.enableVsoCommands) {
+        return new Set();
+    }
+    var list = options.allowedVsoCommands !== undefined
+        ? options.allowedVsoCommands
+        : exports.defaultAllowedVsoCommands;
+    // Command-name comparison is case-insensitive to match the agent's command lookup.
+    return new Set(list.map(function (c) { return c.toLowerCase(); }));
+}
+/**
+ * Normalizes a raw command-name token to the agent's canonical "area.event" form, or null
+ * when it is not a valid command name. Mirrors the agent's Split('.', RemoveEmptyEntries)
+ * with a required length of exactly two non-empty segments.
+ */
+function canonicalCommandName(raw) {
+    var parts = raw.split('.').filter(function (p) { return p.length > 0; });
+    if (parts.length !== 2) {
+        return null;
+    }
+    return (parts[0] + '.' + parts[1]).toLowerCase();
+}
+/** Returns the longest suffix of buf that is a proper marker prefix. */
+function partialMarkerSuffixLength(buf) {
+    var max = Math.min(MARKER.length - 1, buf.length);
+    for (var k = max; k >= 1; k--) {
+        if (buf.compare(MARKER, 0, k, buf.length - k, buf.length) === 0) {
+            return k;
+        }
+    }
+    return 0;
+}
+/**
+ * Locates the end of a command-name header that starts at `start` (the byte after a marker).
+ * The name ends at the first space or ']'. A CR or LF is also reported as a terminator with
+ * newline=true so the caller can fail closed. Scans at most MAX_HEADER bytes; term is -1 when
+ * no terminator is found within that bound (or before the buffer ends).
+ */
+function scanHeader(buf, start) {
+    var limit = Math.min(buf.length, start + MAX_HEADER);
+    for (var k = start; k < limit; k++) {
+        var b = buf[k];
+        if (b === SPACE || b === RBRACKET) {
+            return { term: k, newline: false };
+        }
+        if (b === CR || b === LF) {
+            return { term: k, newline: true };
+        }
+    }
+    return { term: -1, newline: false };
+}
+/**
+ * Stateful, byte-level marker filter. Feed bytes with push() and finish with flush().
+ * Retains only the minimal bytes needed to resolve a marker that straddles a chunk
+ * boundary, so memory stays bounded regardless of input size.
+ */
+var MarkerFilter = /** @class */ (function () {
+    function MarkerFilter(enabled, allowed) {
+        this.enabled = enabled;
+        this.allowed = allowed;
+        this.pending = EMPTY;
+    }
+    MarkerFilter.prototype.push = function (chunk) {
+        var buf = this.pending.length ? Buffer.concat([this.pending, chunk]) : chunk;
+        this.pending = EMPTY;
+        var out = [];
+        var pos = 0;
+        while (pos < buf.length) {
+            var idx = buf.indexOf(MARKER, pos);
+            if (idx === -1) {
+                // No complete marker remains. Retain a possible partial marker at the tail so
+                // it can be completed by the next chunk; emit everything before it.
+                var keep = Math.min(partialMarkerSuffixLength(buf), buf.length - pos);
+                var emitEnd = buf.length - keep;
+                if (emitEnd > pos) {
+                    out.push(pos === 0 && emitEnd === buf.length ? buf : buf.subarray(pos, emitEnd));
+                }
+                this.pending = keep ? buf.subarray(buf.length - keep) : EMPTY;
+                break;
+            }
+            if (idx > pos) {
+                out.push(buf.subarray(pos, idx));
+            }
+            var afterMarker = idx + MARKER.length;
+            if (!this.enabled) {
+                out.push(NEUTRALIZED);
+                pos = afterMarker;
+                continue;
+            }
+            // Enabled: read the command name (up to the first space or ']') and allow the marker
+            // only when that name is allowlisted.
+            var _a = scanHeader(buf, afterMarker), term = _a.term, newline = _a.newline;
+            if (term === -1) {
+                if (buf.length - afterMarker >= MAX_HEADER) {
+                    // No terminator within the bound: fail closed.
+                    out.push(NEUTRALIZED);
+                    pos = afterMarker;
+                    continue;
+                }
+                // Header may complete in a later chunk; retain from the marker start.
+                this.pending = buf.subarray(idx);
+                break;
+            }
+            // A CR/LF before the terminator means the agent (which parses per line) would never
+            // treat this as a command, so we fail closed and neutralize.
+            if (newline) {
+                out.push(NEUTRALIZED);
+                pos = afterMarker;
+                continue;
+            }
+            var name_1 = canonicalCommandName(buf.toString('utf8', afterMarker, term));
+            // Allowlisted markers pass unchanged; the header/data after them flow through as
+            // ordinary bytes and any later markers are evaluated independently.
+            out.push(name_1 && this.allowed.has(name_1) ? MARKER : NEUTRALIZED);
+            pos = afterMarker;
+        }
+        if (out.length === 0) {
+            return EMPTY;
+        }
+        if (out.length === 1) {
+            var only = out[0];
+            // Never expose module-level buffers that callers could mutate globally.
+            return only === NEUTRALIZED || only === MARKER ? Buffer.from(only) : only;
+        }
+        return Buffer.concat(out);
+    };
+    MarkerFilter.prototype.flush = function () {
+        var p = this.pending;
+        this.pending = EMPTY;
+        if (p.length === 0) {
+            return EMPTY;
+        }
+        // An incomplete command candidate that begins with the full marker is neutralized.
+        if (this.enabled && p.length >= MARKER.length && p.subarray(0, MARKER.length).equals(MARKER)) {
+            return Buffer.concat([NEUTRALIZED, p.subarray(MARKER.length)]);
+        }
+        // A partial marker (fewer than the full bytes) cannot be executed by the agent, so it
+        // is safe to emit unchanged.
+        return p;
+    };
+    return MarkerFilter;
+}());
+exports.MarkerFilter = MarkerFilter;
+/**
+ * A Transform stream that neutralizes VSO command markers in external output. Pipe untrusted
+ * output into it; it writes filtered bytes to its readable side (and, via
+ * createExternalOutputStream, on to the destination).
+ */
+var ExternalOutputStream = /** @class */ (function (_super) {
+    __extends(ExternalOutputStream, _super);
+    function ExternalOutputStream(options) {
+        var _this = _super.call(this) || this;
+        _this.markerFilter = new MarkerFilter(!!options.enableVsoCommands, resolveAllowed(options));
+        return _this;
+    }
+    ExternalOutputStream.prototype._transform = function (chunk, _encoding, callback) {
+        try {
+            var buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk), 'utf8');
+            var out = this.markerFilter.push(buf);
+            if (out.length) {
+                this.push(out);
+            }
+            callback();
+        }
+        catch (err) {
+            // Fail closed: never recover by emitting the original marker.
+            callback(err);
+        }
+    };
+    ExternalOutputStream.prototype._flush = function (callback) {
+        try {
+            var out = this.markerFilter.flush();
+            if (out.length) {
+                this.push(out);
+            }
+            callback();
+        }
+        catch (err) {
+            callback(err);
+        }
+    };
+    return ExternalOutputStream;
+}(stream.Transform));
+exports.ExternalOutputStream = ExternalOutputStream;
+/**
+ * Creates a filtering stream for external output and pipes it to the destination
+ * (default process.stdout). Pipe untrusted output into the returned stream, e.g.
+ * `jenkinsResponse.pipe(tl.createExternalOutputStream({ source: 'remote' }))`.
+ */
+function createExternalOutputStream(options) {
+    var filterStream = new ExternalOutputStream(options);
+    var destination = options.destination || process.stdout;
+    // Do not end the shared destination (e.g. process.stdout) when the source ends.
+    filterStream.pipe(destination, { end: false });
+    return filterStream;
+}
+exports.createExternalOutputStream = createExternalOutputStream;
+/**
+ * Filters a complete piece of external output and writes it to the destination
+ * (default process.stdout). Each call is self-contained; for output that arrives in
+ * chunks that may split a marker, use createExternalOutputStream instead.
+ */
+function writeExternalOutput(data, options) {
+    var destination = options.destination || process.stdout;
+    destination.write(filterExternalOutput(data, options));
+}
+exports.writeExternalOutput = writeExternalOutput;
+/** Filters one complete value and returns its bytes without writing them. */
+function filterExternalOutput(data, options) {
+    var filter = new MarkerFilter(!!options.enableVsoCommands, resolveAllowed(options));
+    var buf = Buffer.isBuffer(data) ? data : Buffer.from(String(data), 'utf8');
+    var filtered = filter.push(buf);
+    var pending = filter.flush();
+    return pending.length ? Buffer.concat([filtered, pending]) : filtered;
+}
+exports.filterExternalOutput = filterExternalOutput;
+/** Creates a stateful writer that filters markers split across writes. */
+function createFilteredWriter(options, destination) {
+    var filter = new MarkerFilter(!!options.enableVsoCommands, resolveAllowed(options));
+    var ended = false;
+    return {
+        write: function (data) {
+            if (ended) {
+                throw new Error('Cannot write after end');
+            }
+            var buf = Buffer.isBuffer(data) ? data : Buffer.from(String(data), 'utf8');
+            var filtered = filter.push(buf);
+            if (filtered.length) {
+                destination.write(filtered);
+            }
+        },
+        end: function () {
+            if (ended) {
+                return;
+            }
+            ended = true;
+            var pending = filter.flush();
+            if (pending.length) {
+                destination.write(pending);
+            }
+        }
+    };
+}
+exports.createFilteredWriter = createFilteredWriter;

package/mock-task.d.ts

@@ -4,6 +4,7 @@ import Q = require('q');
 import fs = require('fs');
 import task = require('./task');
 import trm = require('./mock-toolrunner');
+import eom = require('./externaloutput');
 import ma = require('./mock-answer');
 export declare function setAnswers(answers: ma.TaskLibAnswers): void;
 export declare function setResourcePath(path: string): void;
@@ -111,5 +112,10 @@ export declare class CodeCoverageEnabler {
         [key: string]: string;
     }): void;
 }
+export type ExternalOutputOptions = eom.ExternalOutputOptions;
+export declare function createExternalOutputStream(options: eom.ExternalOutputOptions): eom.ExternalOutputStream;
+export declare function writeExternalOutput(data: string | Buffer, options: eom.ExternalOutputOptions): void;
+export declare function filterExternalOutput(data: string | Buffer, options: eom.ExternalOutputOptions): Buffer;
+export declare const defaultAllowedVsoCommands: readonly string[];
 export declare function getHttpProxyConfiguration(requestUrl?: string): task.ProxyConfiguration | null;
 export declare function getHttpCertConfiguration(): task.CertConfiguration | null;

package/mock-task.js

@@ -1,10 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getHttpCertConfiguration = exports.getHttpProxyConfiguration = exports.CodeCoverageEnabler = exports.CodeCoveragePublisher = exports.TestPublisher = exports.legacyFindFiles = exports.findMatch = exports.tool = exports.execSync = exports.execAsync = exports.exec = exports.mv = exports.rmRF = exports.find = exports.retry = exports.cp = exports.ls = exports.which = exports.resolve = exports.mkdirP = exports.checkPath = exports.popd = exports.pushd = exports.cd = exports.cwd = exports.getAgentMode = exports.getNodeMajorVersion = exports.getPlatform = exports.osType = exports.writeFile = exports.exist = exports.stats = exports.FsStats = exports.loc = exports.setResourcePath = exports.setAnswers = void 0;
+exports.getHttpCertConfiguration = exports.getHttpProxyConfiguration = exports.defaultAllowedVsoCommands = exports.filterExternalOutput = exports.writeExternalOutput = exports.createExternalOutputStream = exports.CodeCoverageEnabler = exports.CodeCoveragePublisher = exports.TestPublisher = exports.legacyFindFiles = exports.findMatch = exports.tool = exports.execSync = exports.execAsync = exports.exec = exports.mv = exports.rmRF = exports.find = exports.retry = exports.cp = exports.ls = exports.which = exports.resolve = exports.mkdirP = exports.checkPath = exports.popd = exports.pushd = exports.cd = exports.cwd = exports.getAgentMode = exports.getNodeMajorVersion = exports.getPlatform = exports.osType = exports.writeFile = exports.exist = exports.stats = exports.FsStats = exports.loc = exports.setResourcePath = exports.setAnswers = void 0;
 var path = require("path");
 var task = require("./task");
 var tcm = require("./taskcommand");
 var trm = require("./mock-toolrunner");
+var eom = require("./externaloutput");
 var ma = require("./mock-answer");
 var mock = new ma.MockAnswers();
 function setAnswers(answers) {
@@ -455,6 +456,19 @@ exports.updateReleaseName = task.updateReleaseName;
 exports.TaskCommand = tcm.TaskCommand;
 exports.commandFromString = tcm.commandFromString;
 exports.ToolRunner = trm.ToolRunner;
+function createExternalOutputStream(options) {
+    return eom.createExternalOutputStream(options);
+}
+exports.createExternalOutputStream = createExternalOutputStream;
+function writeExternalOutput(data, options) {
+    eom.writeExternalOutput(data, options);
+}
+exports.writeExternalOutput = writeExternalOutput;
+function filterExternalOutput(data, options) {
+    return eom.filterExternalOutput(data, options);
+}
+exports.filterExternalOutput = filterExternalOutput;
+exports.defaultAllowedVsoCommands = eom.defaultAllowedVsoCommands;
 //-----------------------------------------------------
 // Http Proxy Helper
 //-----------------------------------------------------

package/mock-toolrunner.d.ts

@@ -3,6 +3,7 @@
 import Q = require('q');
 import events = require('events');
 import ma = require('./mock-answer');
+import eom = require('./externaloutput');
 export declare function setAnswers(answers: ma.TaskLibAnswers): void;
 export interface IExecOptions extends IExecSyncOptions {
     failOnStdErr?: boolean;
@@ -14,9 +15,11 @@ export interface IExecSyncOptions {
         [key: string]: string | undefined;
     };
     silent?: boolean;
-    outStream: NodeJS.WritableStream;
-    errStream: NodeJS.WritableStream;
+    outStream?: NodeJS.WritableStream;
+    errStream?: NodeJS.WritableStream;
     windowsVerbatimArguments?: boolean;
+    shell?: boolean;
+    externalOutput?: eom.ExternalOutputOptions;
 }
 export interface IExecSyncResult {
     stdout: string;

package/mock-toolrunner.js

@@ -20,6 +20,7 @@ var Q = require("q");
 var os = require("os");
 var events = require("events");
 var ma = require("./mock-answer");
+var eom = require("./externaloutput");
 var mock = new ma.MockAnswers();
 function setAnswers(answers) {
     mock.initialize(answers);
@@ -149,7 +150,9 @@ var ToolRunner = /** @class */ (function (_super) {
             errStream: options.errStream || process.stderr,
             failOnStdErr: options.failOnStdErr || false,
             ignoreReturnCode: options.ignoreReturnCode || false,
-            windowsVerbatimArguments: options.windowsVerbatimArguments
+            windowsVerbatimArguments: options.windowsVerbatimArguments,
+            shell: options.shell,
+            externalOutput: options.externalOutput
         };
         var argString = this.args.join(' ') || '';
         var cmdString = this.toolPath;
@@ -167,14 +170,16 @@ var ToolRunner = /** @class */ (function (_super) {
                 }
                 cmdString += ' | ' + pipeToolCmdString;
             }
-            ops.outStream.write('[command]' + cmdString + os.EOL);
+            var commandLine = '[command]' + cmdString + os.EOL;
+            ops.outStream.write(ops.externalOutput ? eom.filterExternalOutput(commandLine, ops.externalOutput) : commandLine);
         }
         // TODO: filter process.env
         var res = mock.getResponse('exec', cmdString, debug);
         if (res.stdout) {
             this.emit('stdout', res.stdout);
             if (!ops.silent) {
-                ops.outStream.write(res.stdout + os.EOL);
+                var stdout = res.stdout + os.EOL;
+                ops.outStream.write(ops.externalOutput ? eom.filterExternalOutput(stdout, ops.externalOutput) : stdout);
             }
             var stdLineArray = res.stdout.split(os.EOL);
             for (var _i = 0, _a = stdLineArray.slice(0, -1); _i < _a.length; _i++) {
@@ -190,7 +195,8 @@ var ToolRunner = /** @class */ (function (_super) {
             success = !ops.failOnStdErr;
             if (!ops.silent) {
                 var s = ops.failOnStdErr ? ops.errStream : ops.outStream;
-                s.write(res.stderr + os.EOL);
+                var stderr = res.stderr + os.EOL;
+                s.write(ops.externalOutput ? eom.filterExternalOutput(stderr, ops.externalOutput) : stderr);
             }
             var stdErrArray = res.stderr.split(os.EOL);
             for (var _b = 0, _c = stdErrArray.slice(0, -1); _b < _c.length; _b++) {
@@ -243,7 +249,9 @@ var ToolRunner = /** @class */ (function (_super) {
             errStream: options.errStream || process.stderr,
             failOnStdErr: options.failOnStdErr || false,
             ignoreReturnCode: options.ignoreReturnCode || false,
-            windowsVerbatimArguments: options.windowsVerbatimArguments
+            windowsVerbatimArguments: options.windowsVerbatimArguments,
+            shell: options.shell,
+            externalOutput: options.externalOutput
         };
         var argString = this.args.join(' ') || '';
         var cmdString = this.toolPath;
@@ -261,14 +269,16 @@ var ToolRunner = /** @class */ (function (_super) {
                 }
                 cmdString += ' | ' + pipeToolCmdString;
             }
-            ops.outStream.write('[command]' + cmdString + os.EOL);
+            var commandLine = '[command]' + cmdString + os.EOL;
+            ops.outStream.write(ops.externalOutput ? eom.filterExternalOutput(commandLine, ops.externalOutput) : commandLine);
         }
         // TODO: filter process.env
         var res = mock.getResponse('exec', cmdString, debug);
         if (res.stdout) {
             this.emit('stdout', res.stdout);
             if (!ops.silent) {
-                ops.outStream.write(res.stdout + os.EOL);
+                var stdout = res.stdout + os.EOL;
+                ops.outStream.write(ops.externalOutput ? eom.filterExternalOutput(stdout, ops.externalOutput) : stdout);
             }
             var stdLineArray = res.stdout.split(os.EOL);
             for (var _i = 0, _a = stdLineArray.slice(0, -1); _i < _a.length; _i++) {
@@ -284,7 +294,8 @@ var ToolRunner = /** @class */ (function (_super) {
             success = !ops.failOnStdErr;
             if (!ops.silent) {
                 var s = ops.failOnStdErr ? ops.errStream : ops.outStream;
-                s.write(res.stderr + os.EOL);
+                var stderr = res.stderr + os.EOL;
+                s.write(ops.externalOutput ? eom.filterExternalOutput(stderr, ops.externalOutput) : stderr);
             }
             var stdErrArray = res.stderr.split(os.EOL);
             for (var _b = 0, _c = stdErrArray.slice(0, -1); _b < _c.length; _b++) {
@@ -333,6 +344,8 @@ var ToolRunner = /** @class */ (function (_super) {
             outStream: options.outStream || process.stdout,
             errStream: options.errStream || process.stderr,
             windowsVerbatimArguments: options.windowsVerbatimArguments,
+            shell: options.shell,
+            externalOutput: options.externalOutput
         };
         var argString = this.args.join(' ') || '';
         var cmdString = this.toolPath;
@@ -342,14 +355,15 @@ var ToolRunner = /** @class */ (function (_super) {
             cmdString += (' ' + argString);
         }
         if (!ops.silent) {
-            ops.outStream.write('[command]' + cmdString + os.EOL);
+            var commandLine = '[command]' + cmdString + os.EOL;
+            ops.outStream.write(ops.externalOutput ? eom.filterExternalOutput(commandLine, ops.externalOutput) : commandLine);
         }
         var r = mock.getResponse('exec', cmdString, debug);
         if (!ops.silent && r.stdout && r.stdout.length > 0) {
-            ops.outStream.write(r.stdout);
+            ops.outStream.write(ops.externalOutput ? eom.filterExternalOutput(r.stdout, ops.externalOutput) : r.stdout);
         }
         if (!ops.silent && r.stderr && r.stderr.length > 0) {
-            ops.errStream.write(r.stderr);
+            ops.errStream.write(ops.externalOutput ? eom.filterExternalOutput(r.stderr, ops.externalOutput) : r.stderr);
         }
         return {
             code: r.code,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "azure-pipelines-task-lib",
-  "version": "5.280.0",
+  "version": "5.280.1",
   "description": "Azure Pipelines Task SDK",
   "main": "./task.js",
   "typings": "./task.d.ts",

package/task.d.ts

@@ -4,6 +4,7 @@ import Q = require('q');
 import fs = require('fs');
 import im = require('./internal');
 import trm = require('./toolrunner');
+import eom = require('./externaloutput');
 type OptionCases<T extends string> = `-${Uppercase<T> | Lowercase<T>}`;
 type OptionsPermutations<T extends string, U extends string = ''> = T extends `${infer First}${infer Rest}` ? OptionCases<`${U}${First}`> | OptionCases<`${First}${U}`> | OptionsPermutations<Rest, `${U}${First}`> | OptionCases<First> : OptionCases<U> | '';
 export declare enum TaskResult {
@@ -833,4 +834,43 @@ export declare function addBuildTag(value: string): void;
  * @returns         void
  */
 export declare function updateReleaseName(name: string): void;
+/**
+ * Options controlling how external (untrusted) output is filtered before it is written to
+ * the log. See {@link eom.ExternalOutputOptions}.
+ */
+export type ExternalOutputOptions = eom.ExternalOutputOptions;
+/**
+ * Creates a filtering stream for external output and pipes it to the destination
+ * (default process.stdout). Pipe untrusted output (a remote response, a child process's
+ * stdout, etc.) into the returned stream so that any "##vso[" command markers it contains
+ * are neutralized instead of executed by the agent.
+ *
+ * By default every marker is blocked. Set enableVsoCommands to true (optionally with an
+ * explicit allowedVsoCommands list) to permit a small set of command names on a
+ * compatibility-sensitive path.
+ *
+ * @param options   External output options. See ExternalOutputOptions.
+ * @returns         A writable/readable stream to pipe untrusted output into.
+ */
+export declare function createExternalOutputStream(options: eom.ExternalOutputOptions): eom.ExternalOutputStream;
+/**
+ * Filters a complete piece of external output and writes it to the destination
+ * (default process.stdout). Use this for output already held in a string or Buffer; for
+ * output that streams in chunks that may split a marker, use createExternalOutputStream.
+ *
+ * @param data      The external output to write.
+ * @param options   External output options. See ExternalOutputOptions.
+ * @returns         void
+ */
+export declare function writeExternalOutput(data: string | Buffer, options: eom.ExternalOutputOptions): void;
+/**
+ * Filters a complete piece of external output and returns its bytes without writing them.
+ *
+ * @param data      The external output to filter.
+ * @param options   External output options. See ExternalOutputOptions.
+ * @returns         The filtered output.
+ */
+export declare function filterExternalOutput(data: string | Buffer, options: eom.ExternalOutputOptions): Buffer;
+/** Commands allowed when VSO commands are enabled without an explicit allowlist. */
+export declare const defaultAllowedVsoCommands: readonly string[];
 export {};

package/task.js

@@ -10,7 +10,7 @@ var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getPlatform = exports.osType = exports.writeFile = exports.exist = exports.stats = exports.debug = exports.error = exports.warning = exports.command = exports.setTaskVariable = exports.getTaskVariable = exports.getSecureFileTicket = exports.getSecureFileName = exports.getEndpointAuthorization = exports.getEndpointAuthorizationParameterRequired = exports.getEndpointAuthorizationParameter = exports.getEndpointAuthorizationSchemeRequired = exports.getEndpointAuthorizationScheme = exports.getEndpointDataParameterRequired = exports.getEndpointDataParameter = exports.getEndpointUrlRequired = exports.getEndpointUrl = exports.getPathInputRequired = exports.getPathInput = exports.filePathSupplied = exports.getDelimitedInput = exports.getPipelineFeature = exports.getBoolFeatureFlag = exports.getBoolInput = exports.getInputRequired = exports.getInput = exports.setSecret = exports.setVariable = exports.getVariables = exports.assertAgent = exports.getVariable = exports.loc = exports.setResourcePath = exports.setSanitizedResult = exports.setResult = exports.setErrStream = exports.setStdStream = exports.AgentHostedMode = exports.Platform = exports.IssueSource = exports.FieldType = exports.ArtifactType = exports.IssueType = exports.TaskState = exports.TaskResult = void 0;
-exports.updateReleaseName = exports.addBuildTag = exports.updateBuildNumber = exports.uploadBuildLog = exports.associateArtifact = exports.uploadArtifact = exports.logIssue = exports.logDetail = exports.setProgress = exports.setEndpoint = exports.addAttachment = exports.uploadSummary = exports.prependPath = exports.uploadFile = exports.CodeCoverageEnabler = exports.CodeCoveragePublisher = exports.TestPublisher = exports.getHttpCertConfiguration = exports.getHttpProxyConfiguration = exports.findMatch = exports.filter = exports.match = exports.tool = exports.execSync = exports.exec = exports.execAsync = exports.rmRF = exports.legacyFindFiles = exports.find = exports.retry = exports.mv = exports.cp = exports.ls = exports.which = exports.resolve = exports.mkdirP = exports.popd = exports.pushd = exports.cd = exports.checkPath = exports.cwd = exports.getSprint = exports.getAgentMode = exports.getNodeMajorVersion = void 0;
+exports.defaultAllowedVsoCommands = exports.filterExternalOutput = exports.writeExternalOutput = exports.createExternalOutputStream = exports.updateReleaseName = exports.addBuildTag = exports.updateBuildNumber = exports.uploadBuildLog = exports.associateArtifact = exports.uploadArtifact = exports.logIssue = exports.logDetail = exports.setProgress = exports.setEndpoint = exports.addAttachment = exports.uploadSummary = exports.prependPath = exports.uploadFile = exports.CodeCoverageEnabler = exports.CodeCoveragePublisher = exports.TestPublisher = exports.getHttpCertConfiguration = exports.getHttpProxyConfiguration = exports.findMatch = exports.filter = exports.match = exports.tool = exports.execSync = exports.exec = exports.execAsync = exports.rmRF = exports.legacyFindFiles = exports.find = exports.retry = exports.mv = exports.cp = exports.ls = exports.which = exports.resolve = exports.mkdirP = exports.popd = exports.pushd = exports.cd = exports.checkPath = exports.cwd = exports.getSprint = exports.getAgentMode = exports.getNodeMajorVersion = void 0;
 var childProcess = require("child_process");
 var fs = require("fs");
 var path = require("path");
@@ -19,6 +19,7 @@ var minimatch = require("minimatch");
 var im = require("./internal");
 var tcm = require("./taskcommand");
 var trm = require("./toolrunner");
+var eom = require("./externaloutput");
 var semver = require("semver");
 var TaskResult;
 (function (TaskResult) {
@@ -2414,6 +2415,49 @@ exports.updateReleaseName = updateReleaseName;
 exports.TaskCommand = tcm.TaskCommand;
 exports.commandFromString = tcm.commandFromString;
 exports.ToolRunner = trm.ToolRunner;
+/**
+ * Creates a filtering stream for external output and pipes it to the destination
+ * (default process.stdout). Pipe untrusted output (a remote response, a child process's
+ * stdout, etc.) into the returned stream so that any "##vso[" command markers it contains
+ * are neutralized instead of executed by the agent.
+ *
+ * By default every marker is blocked. Set enableVsoCommands to true (optionally with an
+ * explicit allowedVsoCommands list) to permit a small set of command names on a
+ * compatibility-sensitive path.
+ *
+ * @param options   External output options. See ExternalOutputOptions.
+ * @returns         A writable/readable stream to pipe untrusted output into.
+ */
+function createExternalOutputStream(options) {
+    return eom.createExternalOutputStream(options);
+}
+exports.createExternalOutputStream = createExternalOutputStream;
+/**
+ * Filters a complete piece of external output and writes it to the destination
+ * (default process.stdout). Use this for output already held in a string or Buffer; for
+ * output that streams in chunks that may split a marker, use createExternalOutputStream.
+ *
+ * @param data      The external output to write.
+ * @param options   External output options. See ExternalOutputOptions.
+ * @returns         void
+ */
+function writeExternalOutput(data, options) {
+    eom.writeExternalOutput(data, options);
+}
+exports.writeExternalOutput = writeExternalOutput;
+/**
+ * Filters a complete piece of external output and returns its bytes without writing them.
+ *
+ * @param data      The external output to filter.
+ * @param options   External output options. See ExternalOutputOptions.
+ * @returns         The filtered output.
+ */
+function filterExternalOutput(data, options) {
+    return eom.filterExternalOutput(data, options);
+}
+exports.filterExternalOutput = filterExternalOutput;
+/** Commands allowed when VSO commands are enabled without an explicit allowlist. */
+exports.defaultAllowedVsoCommands = eom.defaultAllowedVsoCommands;
 //-----------------------------------------------------
 // Validation Checks
 //-----------------------------------------------------

package/toolrunner.d.ts

@@ -3,6 +3,7 @@
 /// <reference types="node" />
 import Q = require('q');
 import events = require('events');
+import eom = require('./externaloutput');
 /**
  * Interface for exec options
  */
@@ -32,6 +33,13 @@ export interface IExecSyncOptions {
     windowsVerbatimArguments?: boolean;
     /** optional. Run command inside of the shell.  Defaults to false. */
     shell?: boolean;
+    /**
+     * Optional. When set, the tool's *displayed* output (the command line, stdout and stderr
+     * copies written to the log) is passed through the external-output marker filter so that
+     * "##vso[" commands emitted by the child process are neutralized. Raw stdout/stderr/stdline/
+     * errline events and bytes piped to another tool are NOT affected. See ExternalOutputOptions.
+     */
+    externalOutput?: eom.ExternalOutputOptions;
 }
 /**
  * Interface for exec results returned from synchronous exec functions
@@ -94,6 +102,8 @@ export declare class ToolRunner extends events.EventEmitter {
     private _windowsQuoteCmdArg;
     private _uv_quote_cmd_arg;
     private _cloneExecOptions;
+    /** Builds one filtered writer per display destination. */
+    private _createDisplayFilter;
     private _getSpawnOptions;
     private _getSpawnSyncOptions;
     private execWithPipingAsync;

package/toolrunner.js

@@ -22,6 +22,7 @@ var events = require("events");
 var child = require("child_process");
 var im = require("./internal");
 var fs = require("fs");
+var eom = require("./externaloutput");
 var ToolRunner = /** @class */ (function (_super) {
     __extends(ToolRunner, _super);
     function ToolRunner(toolPath) {
@@ -494,12 +495,37 @@ var ToolRunner = /** @class */ (function (_super) {
             failOnStdErr: options.failOnStdErr || false,
             ignoreReturnCode: options.ignoreReturnCode || false,
             windowsVerbatimArguments: options.windowsVerbatimArguments || false,
-            shell: options.shell || false
+            shell: options.shell || false,
+            externalOutput: options.externalOutput
         };
         result.outStream = options.outStream || process.stdout;
         result.errStream = options.errStream || process.stderr;
         return result;
     };
+    /** Builds one filtered writer per display destination. */
+    ToolRunner.prototype._createDisplayFilter = function (options) {
+        var ext = options.externalOutput;
+        if (!ext) {
+            return null;
+        }
+        var outStream = options.outStream;
+        var errDest = options.failOnStdErr ? options.errStream : options.outStream;
+        var stdoutWriter = eom.createFilteredWriter(ext, outStream);
+        var stderrWriter = errDest === outStream
+            ? stdoutWriter
+            : eom.createFilteredWriter(ext, errDest);
+        return {
+            commandLine: function (text) { outStream.write(eom.filterExternalOutput(text, ext)); },
+            stdout: function (data) { return stdoutWriter.write(data); },
+            stderr: function (data) { return stderrWriter.write(data); },
+            finalize: function () {
+                stdoutWriter.end();
+                if (stderrWriter !== stdoutWriter) {
+                    stderrWriter.end();
+                }
+            }
+        };
+    };
     ToolRunner.prototype._getSpawnOptions = function (options) {
         options = options || {};
         var result = {};
@@ -527,8 +553,14 @@ var ToolRunner = /** @class */ (function (_super) {
         });
         var success = true;
         var optionsNonNull = this._cloneExecOptions(options);
+        var df = this._createDisplayFilter(optionsNonNull);
         if (!optionsNonNull.silent) {
-            optionsNonNull.outStream.write(this._getCommandString(optionsNonNull) + os.EOL);
+            if (df) {
+                df.commandLine(this._getCommandString(optionsNonNull) + os.EOL);
+            }
+            else {
+                optionsNonNull.outStream.write(this._getCommandString(optionsNonNull) + os.EOL);
+            }
         }
         var cp;
         var toolPath = pipeOutputToTool.toolPath;
@@ -550,32 +582,32 @@ var ToolRunner = /** @class */ (function (_super) {
         fileStream = this.pipeOutputToFile ? fs.createWriteStream(this.pipeOutputToFile) : null;
         return new Promise(function (resolve, reject) {
             var _a, _b, _c, _d;
+            var complete = function () {
+                if (waitingEvents != 0) {
+                    return;
+                }
+                if (df) {
+                    df.finalize();
+                }
+                if (error) {
+                    reject(error);
+                }
+                else {
+                    resolve(returnCode);
+                }
+            };
             if (fileStream) {
                 waitingEvents++;
                 fileStream.on('finish', function () {
                     waitingEvents--; //file write is complete
                     fileStream = null;
-                    if (waitingEvents == 0) {
-                        if (error) {
-                            reject(error);
-                        }
-                        else {
-                            resolve(returnCode);
-                        }
-                    }
+                    complete();
                 });
                 fileStream.on('error', function (err) {
                     waitingEvents--; //there were errors writing to the file, write is done
                     _this._debug("Failed to pipe output of ".concat(toolPathFirst, " to file ").concat(_this.pipeOutputToFile, ". Error = ").concat(err));
                     fileStream = null;
-                    if (waitingEvents == 0) {
-                        if (error) {
-                            reject(error);
-                        }
-                        else {
-                            resolve(returnCode);
-                        }
-                    }
+                    complete();
                 });
             }
             //pipe stdout of first tool to stdin of second tool
@@ -600,8 +632,13 @@ var ToolRunner = /** @class */ (function (_super) {
                 }
                 successFirst = !optionsNonNull.failOnStdErr;
                 if (!optionsNonNull.silent) {
-                    var s = optionsNonNull.failOnStdErr ? optionsNonNull.errStream : optionsNonNull.outStream;
-                    s.write(data);
+                    if (df) {
+                        df.stderr(data);
+                    }
+                    else {
+                        var s = optionsNonNull.failOnStdErr ? optionsNonNull.errStream : optionsNonNull.outStream;
+                        s.write(data);
+                    }
                 }
             });
             cpFirst.on('error', function (err) {
@@ -612,9 +649,7 @@ var ToolRunner = /** @class */ (function (_super) {
                 }
                 (_a = cp.stdin) === null || _a === void 0 ? void 0 : _a.end();
                 error = new Error(toolPathFirst + ' failed. ' + err.message);
-                if (waitingEvents == 0) {
-                    reject(error);
-                }
+                complete();
             });
             cpFirst.on('close', function (code, signal) {
                 var _a;
@@ -629,20 +664,18 @@ var ToolRunner = /** @class */ (function (_super) {
                     fileStream.end();
                 }
                 (_a = cp.stdin) === null || _a === void 0 ? void 0 : _a.end();
-                if (waitingEvents == 0) {
-                    if (error) {
-                        reject(error);
-                    }
-                    else {
-                        resolve(returnCode);
-                    }
-                }
+                complete();
             });
             var stdLineBuffer = '';
             (_c = cp.stdout) === null || _c === void 0 ? void 0 : _c.on('data', function (data) {
                 _this.emit('stdout', data);
                 if (!optionsNonNull.silent) {
-                    optionsNonNull.outStream.write(data);
+                    if (df) {
+                        df.stdout(data);
+                    }
+                    else {
+                        optionsNonNull.outStream.write(data);
+                    }
                 }
                 stdLineBuffer = _this._processLineBuffer(data, stdLineBuffer, function (line) {
                     _this.emit('stdline', line);
@@ -653,8 +686,13 @@ var ToolRunner = /** @class */ (function (_super) {
                 _this.emit('stderr', data);
                 success = !optionsNonNull.failOnStdErr;
                 if (!optionsNonNull.silent) {
-                    var s = optionsNonNull.failOnStdErr ? optionsNonNull.errStream : optionsNonNull.outStream;
-                    s.write(data);
+                    if (df) {
+                        df.stderr(data);
+                    }
+                    else {
+                        var s = optionsNonNull.failOnStdErr ? optionsNonNull.errStream : optionsNonNull.outStream;
+                        s.write(data);
+                    }
                 }
                 errLineBuffer = _this._processLineBuffer(data, errLineBuffer, function (line) {
                     _this.emit('errline', line);
@@ -663,9 +701,7 @@ var ToolRunner = /** @class */ (function (_super) {
             cp.on('error', function (err) {
                 waitingEvents--; //process is done with errors
                 error = new Error(toolPath + ' failed. ' + err.message);
-                if (waitingEvents == 0) {
-                    reject(error);
-                }
+                complete();
             });
             cp.on('close', function (code, signal) {
                 waitingEvents--; //process is complete
@@ -687,14 +723,7 @@ var ToolRunner = /** @class */ (function (_super) {
                 else if (!success) {
                     error = new Error(toolPath + ' failed with return code: ' + code);
                 }
-                if (waitingEvents == 0) {
-                    if (error) {
-                        reject(error);
-                    }
-                    else {
-                        resolve(returnCode);
-                    }
-                }
+                complete();
             });
         });
     };
@@ -709,8 +738,14 @@ var ToolRunner = /** @class */ (function (_super) {
         });
         var success = true;
         var optionsNonNull = this._cloneExecOptions(options);
+        var df = this._createDisplayFilter(optionsNonNull);
         if (!optionsNonNull.silent) {
-            optionsNonNull.outStream.write(this._getCommandString(optionsNonNull) + os.EOL);
+            if (df) {
+                df.commandLine(this._getCommandString(optionsNonNull) + os.EOL);
+            }
+            else {
+                optionsNonNull.outStream.write(this._getCommandString(optionsNonNull) + os.EOL);
+            }
         }
         var cp;
         var toolPath = pipeOutputToTool.toolPath;
@@ -730,32 +765,32 @@ var ToolRunner = /** @class */ (function (_super) {
         waitingEvents++;
         cp = child.spawn(pipeOutputToTool._getSpawnFileName(optionsNonNull), pipeOutputToTool._getSpawnArgs(optionsNonNull), pipeOutputToTool._getSpawnOptions(optionsNonNull));
         fileStream = this.pipeOutputToFile ? fs.createWriteStream(this.pipeOutputToFile) : null;
+        var complete = function () {
+            if (waitingEvents != 0) {
+                return;
+            }
+            if (df) {
+                df.finalize();
+            }
+            if (error) {
+                defer.reject(error);
+            }
+            else {
+                defer.resolve(returnCode);
+            }
+        };
         if (fileStream) {
             waitingEvents++;
             fileStream.on('finish', function () {
                 waitingEvents--; //file write is complete
                 fileStream = null;
-                if (waitingEvents == 0) {
-                    if (error) {
-                        defer.reject(error);
-                    }
-                    else {
-                        defer.resolve(returnCode);
-                    }
-                }
+                complete();
             });
             fileStream.on('error', function (err) {
                 waitingEvents--; //there were errors writing to the file, write is done
                 _this._debug("Failed to pipe output of ".concat(toolPathFirst, " to file ").concat(_this.pipeOutputToFile, ". Error = ").concat(err));
                 fileStream = null;
-                if (waitingEvents == 0) {
-                    if (error) {
-                        defer.reject(error);
-                    }
-                    else {
-                        defer.resolve(returnCode);
-                    }
-                }
+                complete();
             });
         }
         //pipe stdout of first tool to stdin of second tool
@@ -778,8 +813,13 @@ var ToolRunner = /** @class */ (function (_super) {
             }
             successFirst = !optionsNonNull.failOnStdErr;
             if (!optionsNonNull.silent) {
-                var s = optionsNonNull.failOnStdErr ? optionsNonNull.errStream : optionsNonNull.outStream;
-                s.write(data);
+                if (df) {
+                    df.stderr(data);
+                }
+                else {
+                    var s = optionsNonNull.failOnStdErr ? optionsNonNull.errStream : optionsNonNull.outStream;
+                    s.write(data);
+                }
             }
         });
         cpFirst.on('error', function (err) {
@@ -790,9 +830,7 @@ var ToolRunner = /** @class */ (function (_super) {
             }
             (_a = cp.stdin) === null || _a === void 0 ? void 0 : _a.end();
             error = new Error(toolPathFirst + ' failed. ' + err.message);
-            if (waitingEvents == 0) {
-                defer.reject(error);
-            }
+            complete();
         });
         cpFirst.on('close', function (code, signal) {
             var _a;
@@ -807,20 +845,18 @@ var ToolRunner = /** @class */ (function (_super) {
                 fileStream.end();
             }
             (_a = cp.stdin) === null || _a === void 0 ? void 0 : _a.end();
-            if (waitingEvents == 0) {
-                if (error) {
-                    defer.reject(error);
-                }
-                else {
-                    defer.resolve(returnCode);
-                }
-            }
+            complete();
         });
         var stdLineBuffer = '';
         (_c = cp.stdout) === null || _c === void 0 ? void 0 : _c.on('data', function (data) {
             _this.emit('stdout', data);
             if (!optionsNonNull.silent) {
-                optionsNonNull.outStream.write(data);
+                if (df) {
+                    df.stdout(data);
+                }
+                else {
+                    optionsNonNull.outStream.write(data);
+                }
             }
             stdLineBuffer = _this._processLineBuffer(data, stdLineBuffer, function (line) {
                 _this.emit('stdline', line);
@@ -831,8 +867,13 @@ var ToolRunner = /** @class */ (function (_super) {
             _this.emit('stderr', data);
             success = !optionsNonNull.failOnStdErr;
             if (!optionsNonNull.silent) {
-                var s = optionsNonNull.failOnStdErr ? optionsNonNull.errStream : optionsNonNull.outStream;
-                s.write(data);
+                if (df) {
+                    df.stderr(data);
+                }
+                else {
+                    var s = optionsNonNull.failOnStdErr ? optionsNonNull.errStream : optionsNonNull.outStream;
+                    s.write(data);
+                }
             }
             errLineBuffer = _this._processLineBuffer(data, errLineBuffer, function (line) {
                 _this.emit('errline', line);
@@ -841,9 +882,7 @@ var ToolRunner = /** @class */ (function (_super) {
         cp.on('error', function (err) {
             waitingEvents--; //process is done with errors
             error = new Error(toolPath + ' failed. ' + err.message);
-            if (waitingEvents == 0) {
-                defer.reject(error);
-            }
+            complete();
         });
         cp.on('close', function (code, signal) {
             waitingEvents--; //process is complete
@@ -865,14 +904,7 @@ var ToolRunner = /** @class */ (function (_super) {
             else if (!success) {
                 error = new Error(toolPath + ' failed with return code: ' + code);
             }
-            if (waitingEvents == 0) {
-                if (error) {
-                    defer.reject(error);
-                }
-                else {
-                    defer.resolve(returnCode);
-                }
-            }
+            complete();
         });
         return defer.promise;
     };
@@ -961,8 +993,14 @@ var ToolRunner = /** @class */ (function (_super) {
             _this._debug('   ' + arg);
         });
         var optionsNonNull = this._cloneExecOptions(options);
+        var df = this._createDisplayFilter(optionsNonNull);
         if (!optionsNonNull.silent) {
-            optionsNonNull.outStream.write(this._getCommandString(optionsNonNull) + os.EOL);
+            if (df) {
+                df.commandLine(this._getCommandString(optionsNonNull) + os.EOL);
+            }
+            else {
+                optionsNonNull.outStream.write(this._getCommandString(optionsNonNull) + os.EOL);
+            }
         }
         var state = new ExecState(optionsNonNull, this.toolPath);
         state.on('debug', function (message) {
@@ -1007,15 +1045,25 @@ var ToolRunner = /** @class */ (function (_super) {
         // it is possible for the child process to end its last line without a new line.
         // because stdout is buffered, this causes the last line to not get sent to the parent
         // stream. Adding this event forces a flush before the child streams are closed.
-        (_a = cp.stdout) === null || _a === void 0 ? void 0 : _a.on('finish', function () {
+        (_a = cp.stdout) === null || _a === void 0 ? void 0 : _a.on('end', function () {
             if (!optionsNonNull.silent) {
-                optionsNonNull.outStream.write(os.EOL);
+                if (df) {
+                    df.stdout(Buffer.from(os.EOL));
+                }
+                else {
+                    optionsNonNull.outStream.write(os.EOL);
+                }
             }
         });
         (_b = cp.stdout) === null || _b === void 0 ? void 0 : _b.on('data', function (data) {
             _this.emit('stdout', data);
             if (!optionsNonNull.silent) {
-                optionsNonNull.outStream.write(data);
+                if (df) {
+                    df.stdout(data);
+                }
+                else {
+                    optionsNonNull.outStream.write(data);
+                }
             }
             stdLineBuffer = _this._processLineBuffer(data, stdLineBuffer, function (line) {
                 _this.emit('stdline', line);
@@ -1025,8 +1073,13 @@ var ToolRunner = /** @class */ (function (_super) {
             state.processStderr = true;
             _this.emit('stderr', data);
             if (!optionsNonNull.silent) {
-                var s = optionsNonNull.failOnStdErr ? optionsNonNull.errStream : optionsNonNull.outStream;
-                s.write(data);
+                if (df) {
+                    df.stderr(data);
+                }
+                else {
+                    var s = optionsNonNull.failOnStdErr ? optionsNonNull.errStream : optionsNonNull.outStream;
+                    s.write(data);
+                }
             }
             errLineBuffer = _this._processLineBuffer(data, errLineBuffer, function (line) {
                 _this.emit('errline', line);
@@ -1046,6 +1099,9 @@ var ToolRunner = /** @class */ (function (_super) {
             state.CheckComplete();
         });
         cp.on('close', function (code, signal) {
+            if (df) {
+                df.finalize();
+            }
             state.processCloseCode = code;
             state.processCloseSignal = signal;
             state.processClosed = true;
@@ -1077,8 +1133,14 @@ var ToolRunner = /** @class */ (function (_super) {
             _this._debug('   ' + arg);
         });
         var optionsNonNull = this._cloneExecOptions(options);
+        var df = this._createDisplayFilter(optionsNonNull);
         if (!optionsNonNull.silent) {
-            optionsNonNull.outStream.write(this._getCommandString(optionsNonNull) + os.EOL);
+            if (df) {
+                df.commandLine(this._getCommandString(optionsNonNull) + os.EOL);
+            }
+            else {
+                optionsNonNull.outStream.write(this._getCommandString(optionsNonNull) + os.EOL);
+            }
         }
         var state = new ExecState(optionsNonNull, this.toolPath);
         state.on('debug', function (message) {
@@ -1119,15 +1181,25 @@ var ToolRunner = /** @class */ (function (_super) {
         // it is possible for the child process to end its last line without a new line.
         // because stdout is buffered, this causes the last line to not get sent to the parent
         // stream. Adding this event forces a flush before the child streams are closed.
-        (_a = cp.stdout) === null || _a === void 0 ? void 0 : _a.on('finish', function () {
+        (_a = cp.stdout) === null || _a === void 0 ? void 0 : _a.on('end', function () {
             if (!optionsNonNull.silent) {
-                optionsNonNull.outStream.write(os.EOL);
+                if (df) {
+                    df.stdout(Buffer.from(os.EOL));
+                }
+                else {
+                    optionsNonNull.outStream.write(os.EOL);
+                }
             }
         });
         (_b = cp.stdout) === null || _b === void 0 ? void 0 : _b.on('data', function (data) {
             _this.emit('stdout', data);
             if (!optionsNonNull.silent) {
-                optionsNonNull.outStream.write(data);
+                if (df) {
+                    df.stdout(data);
+                }
+                else {
+                    optionsNonNull.outStream.write(data);
+                }
             }
             stdLineBuffer = _this._processLineBuffer(data, stdLineBuffer, function (line) {
                 _this.emit('stdline', line);
@@ -1137,8 +1209,13 @@ var ToolRunner = /** @class */ (function (_super) {
             state.processStderr = true;
             _this.emit('stderr', data);
             if (!optionsNonNull.silent) {
-                var s = optionsNonNull.failOnStdErr ? optionsNonNull.errStream : optionsNonNull.outStream;
-                s.write(data);
+                if (df) {
+                    df.stderr(data);
+                }
+                else {
+                    var s = optionsNonNull.failOnStdErr ? optionsNonNull.errStream : optionsNonNull.outStream;
+                    s.write(data);
+                }
             }
             errLineBuffer = _this._processLineBuffer(data, errLineBuffer, function (line) {
                 _this.emit('errline', line);
@@ -1158,6 +1235,9 @@ var ToolRunner = /** @class */ (function (_super) {
             state.CheckComplete();
         });
         cp.on('close', function (code, signal) {
+            if (df) {
+                df.finalize();
+            }
             state.processCloseCode = code;
             state.processCloseSignal = signal;
             state.processClosed = true;
@@ -1185,15 +1265,17 @@ var ToolRunner = /** @class */ (function (_super) {
         });
         var success = true;
         options = this._cloneExecOptions(options);
+        var ext = options.externalOutput;
         if (!options.silent) {
-            options.outStream.write(this._getCommandString(options) + os.EOL);
+            var cmdLine = this._getCommandString(options) + os.EOL;
+            options.outStream.write(ext ? eom.filterExternalOutput(cmdLine, ext) : cmdLine);
         }
         var r = child.spawnSync(this._getSpawnFileName(options), this._getSpawnArgs(options), this._getSpawnSyncOptions(options));
         if (!options.silent && r.stdout && r.stdout.length > 0) {
-            options.outStream.write(r.stdout);
+            options.outStream.write(ext ? eom.filterExternalOutput(r.stdout, ext) : r.stdout);
         }
         if (!options.silent && r.stderr && r.stderr.length > 0) {
-            options.errStream.write(r.stderr);
+            options.errStream.write(ext ? eom.filterExternalOutput(r.stderr, ext) : r.stderr);
         }
         var res = { code: r.status, error: r.error };
         res.stdout = (r.stdout) ? r.stdout.toString() : '';