{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-362-check-the-encoded-payload-size-before-using-linux-custom-script-s-inline-script/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-362-check-the-encoded-payload-size-before-using-linux-custom-script-s-inline-script/", "slug": "dse-20260909-362-check-the-encoded-payload-size-before-using-linux-custom-script-s-inline-script", "url": "https://update.dsesecurity.com/updates/dse-20260909-362-check-the-encoded-payload-size-before-using-linux-custom-script-s-inline-script/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-362-check-the-encoded-payload-size-before-using-linux-custom-script-s-inline-script.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-362-check-the-encoded-payload-size-before-using-linux-custom-script-s-inline-script/" }, "title": "Check the encoded payload size before using Linux Custom Script's inline script setting", "summary": "Which representation does the Linux Custom Script extension size-check before decoding an inline script?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "managed-it", "label": "Managed IT operations", "alt": "A controlled technology lifecycle progressing from assessment to approved production.", "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:25:54+00:00", "modified_at": "2026-09-10T02:01:56+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 246, "potentially_affected": "Owners packaging inline scripts for Azure Custom Script Extension Version 2 on a supported Linux VM.", "dse_recommendation": "Validate the exact encoded setting that will be submitted, not only the source file on disk.", "primary_source": { "name": "Run Custom Script Extension on Linux VMs in Azure - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/custom-script-linux", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

The Linux Custom Script extension accepts an inline script as Base64, optionally compressed with gzip first. It checks the submitted script value against a 256 KB limit before decoding or attempting decompression. The resulting file runs through /bin/sh. A script value can be supplied in public or protected settings, but specifying it in both is rejected; Microsoft recommends protected settings. Microsoft Learn.

\n

Applicability

\n

Use this check when a deployment pipeline embeds a script instead of downloading it through a file URI. Identify the exact payload-generation step and intended execution environment, especially when a locally successful script fails before its expected work begins.

\n

DSE recommendation

\n

Validate the exact encoded setting that will be submitted, not only the source file on disk. Have the deployment owner preserve a reproducible relationship between the reviewed script and its encoded payload. Choose one settings location and inspect the final configuration for accidental duplication. Keep confidential inputs out of ordinary diagnostic output, and review shell compatibility before deployment.

\n

Verification

\n

Generate the deployment value in a controlled environment and check its size before submission. Decode it locally to compare with the reviewed input, then exercise the intended script on a representative test VM. Inspect extension evidence to distinguish payload validation, decoding, and application execution. Record the reviewed artifact identity and sanitized outcome rather than copying the complete encoded value into a ticket, particularly if it contains sensitive material.

\n

Official references

\n

Microsoft Learn: Custom Script Extension Version 2 for Linux. Source reviewed September 9, 2026.

", "content_text": "Source facts\nThe Linux Custom Script extension accepts an inline script as Base64, optionally compressed with gzip first. It checks the submitted script value against a 256 KB limit before decoding or attempting decompression. The resulting file runs through /bin/sh. A script value can be supplied in public or protected settings, but specifying it in both is rejected; Microsoft recommends protected settings. Microsoft Learn.\nApplicability\nUse this check when a deployment pipeline embeds a script instead of downloading it through a file URI. Identify the exact payload-generation step and intended execution environment, especially when a locally successful script fails before its expected work begins.\nDSE recommendation\nValidate the exact encoded setting that will be submitted, not only the source file on disk. Have the deployment owner preserve a reproducible relationship between the reviewed script and its encoded payload. Choose one settings location and inspect the final configuration for accidental duplication. Keep confidential inputs out of ordinary diagnostic output, and review shell compatibility before deployment.\nVerification\nGenerate the deployment value in a controlled environment and check its size before submission. Decode it locally to compare with the reviewed input, then exercise the intended script on a representative test VM. Inspect extension evidence to distinguish payload validation, decoding, and application execution. Record the reviewed artifact identity and sanitized outcome rather than copying the complete encoded value into a ticket, particularly if it contains sensitive material.\nOfficial references\nMicrosoft Learn: Custom Script Extension Version 2 for Linux. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nThe Linux Custom Script extension accepts an inline script as Base64, optionally compressed with gzip first. It checks the submitted script value against a 256 KB limit before decoding or attempting decompression. The resulting file runs through /bin/sh. A script value can be supplied in public or protected settings, but specifying it in both is rejected; Microsoft recommends protected settings. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/custom-script-linux).\n\n## Applicability\n\nUse this check when a deployment pipeline embeds a script instead of downloading it through a file URI. Identify the exact payload-generation step and intended execution environment, especially when a locally successful script fails before its expected work begins.\n\n## DSE recommendation\n\nValidate the exact encoded setting that will be submitted, not only the source file on disk. Have the deployment owner preserve a reproducible relationship between the reviewed script and its encoded payload. Choose one settings location and inspect the final configuration for accidental duplication. Keep confidential inputs out of ordinary diagnostic output, and review shell compatibility before deployment.\n\n## Verification\n\nGenerate the deployment value in a controlled environment and check its size before submission. Decode it locally to compare with the reviewed input, then exercise the intended script on a representative test VM. Inspect extension evidence to distinguish payload validation, decoding, and application execution. Record the reviewed artifact identity and sanitized outcome rather than copying the complete encoded value into a ticket, particularly if it contains sensitive material.\n\n## Official references\n\n[Microsoft Learn: Custom Script Extension Version 2 for Linux](https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/custom-script-linux). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-362-check-the-encoded-payload-size-before-using-linux-custom-script-s-inline-script/", "url": "https://update.dsesecurity.com/updates/dse-20260909-362-check-the-encoded-payload-size-before-using-linux-custom-script-s-inline-script/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-362-check-the-encoded-payload-size-before-using-linux-custom-script-s-inline-script/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Check the encoded payload size before using Linux Custom Script's inline script setting", "item": "https://update.dsesecurity.com/updates/dse-20260909-362-check-the-encoded-payload-size-before-using-linux-custom-script-s-inline-script/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-362-check-the-encoded-payload-size-before-using-linux-custom-script-s-inline-script/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-362-check-the-encoded-payload-size-before-using-linux-custom-script-s-inline-script/", "url": "https://update.dsesecurity.com/updates/dse-20260909-362-check-the-encoded-payload-size-before-using-linux-custom-script-s-inline-script/", "headline": "Check the encoded payload size before using Linux Custom Script's inline script setting", "description": "Which representation does the Linux Custom Script extension size-check before decoding an inline script?", "abstract": "Which representation does the Linux Custom Script extension size-check before decoding an inline script?", "articleBody": "Source facts\nThe Linux Custom Script extension accepts an inline script as Base64, optionally compressed with gzip first. It checks the submitted script value against a 256 KB limit before decoding or attempting decompression. The resulting file runs through /bin/sh. A script value can be supplied in public or protected settings, but specifying it in both is rejected; Microsoft recommends protected settings. Microsoft Learn.\nApplicability\nUse this check when a deployment pipeline embeds a script instead of downloading it through a file URI. Identify the exact payload-generation step and intended execution environment, especially when a locally successful script fails before its expected work begins.\nDSE recommendation\nValidate the exact encoded setting that will be submitted, not only the source file on disk. Have the deployment owner preserve a reproducible relationship between the reviewed script and its encoded payload. Choose one settings location and inspect the final configuration for accidental duplication. Keep confidential inputs out of ordinary diagnostic output, and review shell compatibility before deployment.\nVerification\nGenerate the deployment value in a controlled environment and check its size before submission. Decode it locally to compare with the reviewed input, then exercise the intended script on a representative test VM. Inspect extension evidence to distinguish payload validation, decoding, and application execution. Record the reviewed artifact identity and sanitized outcome rather than copying the complete encoded value into a ticket, particularly if it contains sensitive material.\nOfficial references\nMicrosoft Learn: Custom Script Extension Version 2 for Linux. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:25:54+00:00", "dateModified": "2026-09-10T02:01:56+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-362-check-the-encoded-payload-size-before-using-linux-custom-script-s-inline-script/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-362-check-the-encoded-payload-size-before-using-linux-custom-script-s-inline-script/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Check the encoded payload size before using Linux Custom Script's inline script setting" }, "articleSection": [ "IT" ], "keywords": [ "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 246, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Run Custom Script Extension on Linux VMs in Azure - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/custom-script-linux" } } ] } }