Escaping special characters in ReplaceTokens Secrets about cols-agent-tasks HOT 2 CLOSED

hey @joshfitabase - not sure what you mean by "additional security"? What else are you looking for other than masking in the logs? By the way, the new (.NET Core) agent that uses vsts-task-lib actually passes the secret variables to the task, so sometime soon I'll remove the property from the frontend (passing it in via K:V pairs was a hack since the current vso-task-lib doesn't pass secret variables to the tasks).

from cols-agent-tasks.

@colindembovsky thanks for the quick reply! That's pretty much what I expected. I wasn't sure what else it could be doing for me behind the scenes, but I wanted to cover my bases in case your reply was something like "due to strange quirks in the vsts environment https doesn't get used for that logging data so you really want to obfuscate it"

It still would be nice to have an escape sequence for those characters, but sounds like it isn't a dealbreaker if the only security concern is someone with direct account access (or standing behind me)

from cols-agent-tasks.