@@ -475,14 +475,25 @@ export class WebApi {
475475 if ( lookupKey && lookupKey . indexOf ( ':' ) > 0 ) {
476476 let lookupInfo : string [ ] = lookupKey . split ( ':' , 2 ) ;
477477
478- // file contains encryption key
479- let keyFile = new Buffer ( lookupInfo [ 0 ] , 'base64' ) . toString ( 'utf8' ) ;
480- let encryptKey = new Buffer ( fs . readFileSync ( keyFile , 'utf8' ) , 'base64' ) ;
478+ let keyFile = Buffer . from ( lookupInfo [ 0 ] , 'base64' ) . toString ( 'utf8' ) ;
479+ let keyAndIv = fs . readFileSync ( keyFile , 'utf8' ) ;
480+
481+ let [ keyBase64 , ivBase64 ] = keyAndIv . split ( ':' , 2 ) ;
482+
483+ if ( ! keyBase64 || ! ivBase64 ) {
484+ throw new Error (
485+ 'Invalid encryption key format. Expected "key:iv" format from azure-pipelines-task-lib 5.2.4+. ' +
486+ 'This version of azure-devops-node-api (15.2.0+) is not compatible with task-lib <5.2.4.'
487+ ) ;
488+ }
489+
490+ let encryptKey = Buffer . from ( keyBase64 , 'base64' ) ;
491+ let iv = Buffer . from ( ivBase64 , 'base64' ) ;
481492
482- let encryptedContent : string = new Buffer ( lookupInfo [ 1 ] , 'base64' ) . toString ( 'utf8' ) ;
493+ let encryptedContent : string = Buffer . from ( lookupInfo [ 1 ] , 'base64' ) . toString ( 'utf8' ) ;
483494
484- let decipher = crypto . createDecipher ( "aes-256-ctr" , encryptKey )
485- let decryptedContent = decipher . update ( encryptedContent , 'hex' , 'utf8' )
495+ let decipher = crypto . createDecipheriv ( "aes-256-ctr" , encryptKey , iv ) ;
496+ let decryptedContent = decipher . update ( encryptedContent , 'hex' , 'utf8' ) ;
486497 decryptedContent += decipher . final ( 'utf8' ) ;
487498
488499 return decryptedContent ;
0 commit comments