Escape newlines in env var substitution

server/hook.go

@@ -8,6 +8,7 @@ import (
 	"math/rand"
 	"regexp"
 	"strconv"
+	"strings"
 	"time"
 
 	"github.com/gin-gonic/gin"
@@ -461,7 +462,11 @@ func (b *builder) Build() ([]*buildItem, error) {
 
 		y := b.Yaml
 		s, err := envsubst.Eval(y, func(name string) string {
-			return environ[name]
+			env := environ[name]
+			if strings.Contains(env, "\n") {
+				env = fmt.Sprintf("%q", env)
+			}
+			return env
 		})
 		if err != nil {
 			return nil, err

server/hook_test.go

@@ -0,0 +1,31 @@
+package server
+
+import (
+	"testing"
+
+	"github.com/drone/drone/model"
+)
+
+func TestMultilineEnvsubst(t *testing.T) {
+	b := builder{
+		Repo: &model.Repo{},
+		Curr: &model.Build{
+			Message: `aaa
+bbb`,
+		},
+		Last: &model.Build{},
+		Netrc: &model.Netrc{},
+		Secs: []*model.Secret{},
+		Regs: []*model.Registry{},
+		Link: "",
+		Yaml: `pipeline:
+  xxx:
+    image: scratch
+    yyy: ${DRONE_COMMIT_MESSAGE}
+`,
+	}
+
+	if _, err := b.Build(); err != nil {
+		t.Fatal(err)
+	}
+}