# Check the encoded payload size before using Linux Custom Script's inline script setting

> Which representation does the Linux Custom Script extension size-check before decoding an inline script?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-362-check-the-encoded-payload-size-before-using-linux-custom-script-s-inline-script/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:25:54+00:00
- Modified: 2026-09-10T02:01:56+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: IT
- Reading time: 2 minutes

## What you need to know

Which representation does the Linux Custom Script extension size-check before decoding an inline script?

## Potentially affected

Owners packaging inline scripts for Azure Custom Script Extension Version 2 on a supported Linux VM.

## DSE recommendation

Validate the exact encoded setting that will be submitted, not only the source file on disk.

## Article

## Source facts

The Linux Custom Script extension accepts an inline script as Base64, optionally compressed with gzip first. It checks the submitted script value against a 256 KB limit before decoding or attempting decompression. The resulting file runs through /bin/sh. A script value can be supplied in public or protected settings, but specifying it in both is rejected; Microsoft recommends protected settings. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/custom-script-linux).

## Applicability

Use this check when a deployment pipeline embeds a script instead of downloading it through a file URI. Identify the exact payload-generation step and intended execution environment, especially when a locally successful script fails before its expected work begins.

## DSE recommendation

Validate the exact encoded setting that will be submitted, not only the source file on disk. Have the deployment owner preserve a reproducible relationship between the reviewed script and its encoded payload. Choose one settings location and inspect the final configuration for accidental duplication. Keep confidential inputs out of ordinary diagnostic output, and review shell compatibility before deployment.

## Verification

Generate the deployment value in a controlled environment and check its size before submission. Decode it locally to compare with the reviewed input, then exercise the intended script on a representative test VM. Inspect extension evidence to distinguish payload validation, decoding, and application execution. Record the reviewed artifact identity and sanitized outcome rather than copying the complete encoded value into a ticket, particularly if it contains sensitive material.

## Official references

[Microsoft Learn: Custom Script Extension Version 2 for Linux](https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/custom-script-linux). Source reviewed September 9, 2026.

## Primary reference

- Name: Run Custom Script Extension on Linux VMs in Azure - Azure Virtual Machines | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/custom-script-linux
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Check the encoded payload size before using Linux Custom Script's inline script setting,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-362-check-the-encoded-payload-size-before-using-linux-custom-script-s-inline-script/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.