Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

DevOps secrets injects Byte Order Mark (BOM) into strings #715

Open
rsegecin opened this issue Aug 20, 2024 · 0 comments
Open

DevOps secrets injects Byte Order Mark (BOM) into strings #715

rsegecin opened this issue Aug 20, 2024 · 0 comments

Comments

@rsegecin
Copy link

rsegecin commented Aug 20, 2024

When creating Docker secrets from the Azure DevOps pipeline library, a Byte Order Mark (BOM) consisting of ASCII characters 239, 187, and 191 is being prepended to the secret value. This prevents the secret from being used correctly in sensitive contexts such as passwords or certificates.

I request that the pipeline library be modified to prevent the injection of BOM characters into created secrets to ensure their integrity and usability.

if the secret is record in the pipeline library as SERVICE_PFX_PASSWORD="asd" when a script in the pipeline runs:

echo "$(SERVICE_PFX_PASSWORD)" | docker secret create service_pfx_password -

it will echo SERVICE_PFX_PASSWORD with " asd" being the first three characters the injected BOM characters.

PS: The agent where this script is running is a Windows machine.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant