[BUG]: Deployment Error with AzureRmWebAppDeployment Task Version 4.243.3 [Malicious entry: Content\D_C\]

[sarbagya-lang]

New issue checklist

• I searched for existing GitHub issues
• I read pipeline troubleshooting guide
• I checked how to collect logs

Task name

Azure App Service deploy

Task version

4.243.3

Issue Description

**!!!**I'm encountering an issue while deploying to my Azure App Service using the AzureRmWebAppDeployment@4 task in Azure DevOps. It seems to be related to the recent version change to 4.243.3.Any help will be appreciated!

Environment type (Please select at least one enviroment where you face this issue)

• Self-Hosted
• Microsoft Hosted
• VMSS Pool
• Container

Azure DevOps Server type

dev.azure.com (formerly visualstudio.com)

Azure DevOps Server Version (if applicable)

No response

Operation system

Windows-latest

Relevant log output

2024-07-31T20:35:52.1273785Z ##[section]Starting: App Service Deploy: app-unifiedplatform-nonprod
2024-07-31T20:35:52.1282714Z ==============================================================================
2024-07-31T20:35:52.1282861Z Task         : Azure App Service deploy
2024-07-31T20:35:52.1282947Z Description  : Deploy to Azure App Service a web, mobile, or API app using Docker, Java, .NET, .NET Core, Node.js, PHP, Python, or Ruby
2024-07-31T20:35:52.1283130Z Version      : 4.243.3
2024-07-31T20:35:52.1283200Z Author       : Microsoft Corporation
2024-07-31T20:35:52.1283280Z Help         : https://aka.ms/azureappservicetroubleshooting
2024-07-31T20:35:52.1283379Z ==============================================================================
2024-07-31T20:35:52.8613703Z Got service connection details for Azure App Service:'app-xxxxxxx'
2024-07-31T20:35:55.0804417Z [command]D:\a\_tasks\AzureRmWebAppDeployment_497d490f-eea7-4f2b-ab94-48d9c1acdcb1\4.243.3\node_modules\azure-pipelines-tasks-webdeployment-common\7zip\7zip\7z.exe x -oD:\a\_temp\temp_web_package_2604279885253533 "D:\a\r1\a\_Supply Chain Unified Platform\$(Parameters.ArtifactName)\FAOM.Web.zip"
2024-07-31T20:35:55.1112643Z 
2024-07-31T20:35:55.1113308Z 7-Zip 23.01 (x64) : Copyright (c) 1999-2023 Igor Pavlov : 2023-06-20
2024-07-31T20:35:55.1113443Z 
2024-07-31T20:35:55.1114041Z Scanning the drive for archives:
2024-07-31T20:35:55.1114325Z 1 file, 111508820 bytes (107 MiB)
2024-07-31T20:35:55.1114409Z 
2024-07-31T20:35:55.1114664Z Extracting archive: D:\a\r1\a\_Supply Chain Unified Platform\$(Parameters.ArtifactName)\FAOM.Web.zip
2024-07-31T20:35:59.2696194Z --
2024-07-31T20:35:59.2696750Z Path = D:\a\r1\a\_Supply Chain Unified Platform\$(Parameters.ArtifactName)\FAOM.Web.zip
2024-07-31T20:35:59.2697249Z Type = zip
2024-07-31T20:35:59.2697563Z Physical Size = 111508820
2024-07-31T20:35:59.2697772Z 
2024-07-31T20:35:59.2711221Z Everything is Ok
2024-07-31T20:35:59.2711456Z 
2024-07-31T20:35:59.2711754Z Folders: 83
2024-07-31T20:35:59.2712082Z Files: 6573
2024-07-31T20:35:59.2712348Z Size:       252502768
2024-07-31T20:35:59.2712679Z Compressed: 111508820
2024-07-31T20:35:59.2727438Z 
2024-07-31T20:35:59.2806003Z ##[error]Error: Malicious entry: Content\D_C\

Full task logs with system.debug enabled

 2024-07-31T20:35:52.1273785Z ##[section]Starting: App Service Deploy: app-unifiedplatform-nonprod
2024-07-31T20:35:52.1282714Z ==============================================================================
2024-07-31T20:35:52.1282861Z Task         : Azure App Service deploy
2024-07-31T20:35:52.1282947Z Description  : Deploy to Azure App Service a web, mobile, or API app using Docker, Java, .NET, .NET Core, Node.js, PHP, Python, or Ruby
2024-07-31T20:35:52.1283130Z Version      : 4.243.3
2024-07-31T20:35:52.1283200Z Author       : Microsoft Corporation
2024-07-31T20:35:52.1283280Z Help         : https://aka.ms/azureappservicetroubleshooting
2024-07-31T20:35:52.1283379Z ==============================================================================
2024-07-31T20:35:52.8613703Z Got service connection details for Azure App Service:'app-xxxxxx'
2024-07-31T20:35:55.0804417Z [command]D:\a\_tasks\AzureRmWebAppDeployment_497d490f-eea7-4f2b-ab94-48d9c1acdcb1\4.243.3\node_modules\azure-pipelines-tasks-webdeployment-common\7zip\7zip\7z.exe x -oD:\a\_temp\temp_web_package_2604279885253533 "D:\a\r1\a\_Supply Chain Unified Platform\$(Parameters.ArtifactName)\FAOM.Web.zip"
2024-07-31T20:35:55.1112643Z 
2024-07-31T20:35:55.1113308Z 7-Zip 23.01 (x64) : Copyright (c) 1999-2023 Igor Pavlov : 2023-06-20
2024-07-31T20:35:55.1113443Z 
2024-07-31T20:35:55.1114041Z Scanning the drive for archives:
2024-07-31T20:35:55.1114325Z 1 file, 111508820 bytes (107 MiB)
2024-07-31T20:35:55.1114409Z 
2024-07-31T20:35:55.1114664Z Extracting archive: D:\a\r1\a\_Supply Chain Unified Platform\$(Parameters.ArtifactName)\FAOM.Web.zip
2024-07-31T20:35:59.2696194Z --
2024-07-31T20:35:59.2696750Z Path = D:\a\r1\a\_Supply Chain Unified Platform\$(Parameters.ArtifactName)\FAOM.Web.zip
2024-07-31T20:35:59.2697249Z Type = zip
2024-07-31T20:35:59.2697563Z Physical Size = 111508820
2024-07-31T20:35:59.2697772Z 
2024-07-31T20:35:59.2711221Z Everything is Ok
2024-07-31T20:35:59.2711456Z 
2024-07-31T20:35:59.2711754Z Folders: 83
2024-07-31T20:35:59.2712082Z Files: 6573
2024-07-31T20:35:59.2712348Z Size:       252502768
2024-07-31T20:35:59.2712679Z Compressed: 111508820
2024-07-31T20:35:59.2727438Z 
2024-07-31T20:35:59.2806003Z ##[error]Error: Malicious entry: Content\D_C\ 

Repro steps

No response

[v-schhabra]

Fix has been created for this issue in this PR #20218
Please wait for the deployments to complete on all the rings.

[oliviercochet]

We encounter the same issue.

[rvenables]

@v-schhabra Thanks for the update. We're also impacted by this bug and I'm guessing there are other folks out there that might be curious about timing. So we can plan, when do you anticipate this fix going out to all Azure Pipelines users?

[naviln]

An update on this? I logged the issue almost a week ago (Jul 31st) and still our release pipelines are failing: https://developercommunity.visualstudio.com/t/Deployment-Failed-with-Error:-Error:-Mal/10712900

[v-schhabra]

Hi @rvenables @naviln
Sorry for the inconvenience caused. The deployments will be completed on 8thAugust for all the rings.

[joaoloboguerraneto]

I'm getting the same error in my pipeline and it's affecting the team that needs to update by the 18th.
##[error]Error: Malicious entry: Content\D_C\a\1\s\web\dcWebsite\obj\Release\Package\PackageTmp.flowconfig

[naviln]

Thank you, it is now working for my team.