[BUG]: Malicious entry in .flowconfig

[joaoloboguerraneto]

New issue checklist

• I searched for existing GitHub issues
• I read pipeline troubleshooting guide
• I checked how to collect logs

Task name

AzureRmWebAppDeployment@4

Task version

No response

Issue Description

Azure App Service Deploy Service

Starting: Azure App Service Deploy Service

Task : Azure App Service deploy
Description : Deploy to Azure App Service a web, mobile, or API app using Docker, Java, .NET, .NET Core, Node.js, PHP, Python, or Ruby
Version : 4.243.3
Author : Microsoft Corporation
Help : https://aka.ms/azureappservicetroubleshooting

Got service connection details for Azure App Service:'mrt3EnvCrowdPortal'
D:\a_tasks\AzureRmWebAppDeployment_****\4.243.3\node_modules\azure-pipelines-tasks-webdeployment-common\7zip\7zip\7z.exe x -oD:\a_temp\temp_web_package_8574758913011411 D:\a\1\s\DCWebsite.zip

7-Zip 23.01 (x64) : Copyright (c) 1999-2023 Igor Pavlov : 2023-06-20

Scanning the drive for archives:
1 file, 57484321 bytes (55 MiB)

Extracting archive: D:\a\1\s\DCWebsite.zip

Path = D:\a\1\s\DCWebsite.zip
Type = zip
Physical Size = 57484321

Everything is Ok

Files: 1628
Size: 164774060
Compressed: 57484321

##[error]Error: Malicious entry: Content\D_C\a\1\s\web\dcWebsite\obj\Release\Package\PackageTmp.flowconfig
Successfully updated deployment History at https://.scm.azurewebsites.net/api/deployments/
App Service Application URL: https://****.azurewebsites.net/
Finishing: Azure App Service Deploy Service

Environment type (Please select at least one enviroment where you face this issue)

• Self-Hosted
• Microsoft Hosted
• VMSS Pool
• Container

Azure DevOps Server type

dev.azure.com (formerly visualstudio.com)

Azure DevOps Server Version (if applicable)

No response

Operation system

ubuntu latest

Relevant log output

Azure App Service Deploy Service

Starting: Azure App Service Deploy Service
==============================================================================
Task         : Azure App Service deploy
Description  : Deploy to Azure App Service a web, mobile, or API app using Docker, Java, .NET, .NET Core, Node.js, PHP, Python, or Ruby
Version      : 4.243.3
Author       : Microsoft Corporation
Help         : https://aka.ms/azureappservicetroubleshooting
==============================================================================
Got service connection details for Azure App Service:'mrt3EnvCrowdPortal'
D:\a\_tasks\AzureRmWebAppDeployment_****\4.243.3\node_modules\azure-pipelines-tasks-webdeployment-common\7zip\7zip\7z.exe x -oD:\a\_temp\temp_web_package_8574758913011411 D:\a\1\s\DCWebsite.zip

7-Zip 23.01 (x64) : Copyright (c) 1999-2023 Igor Pavlov : 2023-06-20

Scanning the drive for archives:
1 file, 57484321 bytes (55 MiB)

Extracting archive: D:\a\1\s\DCWebsite.zip
--
Path = D:\a\1\s\DCWebsite.zip
Type = zip
Physical Size = 57484321

Everything is Ok

Files: 1628
Size:       164774060
Compressed: 57484321

##[error]Error: Malicious entry: Content\D_C\a\1\s\web\dcWebsite\obj\Release\Package\PackageTmp\.flowconfig
Successfully updated deployment History at https://****.scm.azurewebsites.net/api/deployments/****
App Service Application URL: https://****.azurewebsites.net/
Finishing: Azure App Service Deploy Service

Full task logs with system.debug enabled

 [REPLACE THIS WITH YOUR INFORMATION] 

Repro steps

No response

[JohanGovers]

I'm experiencing the same thing.

[rvenables]

It looks like this may have also been resolved in PR #20218 (See issue & discussion on #20236).

Can anyone on the release side help us better understand timing for when this might be deployed?