Current Behavior
The amazon-dcv-windows module interpolates admin_password into two places without escaping it for the target syntax, so passwords containing common special characters silently become a different password.
1. PowerShell double-quoted string — install-dcv.ps1:2
$adminPassword = "${admin_password}"$, backtick, and " are all interpreted inside a PowerShell double-quoted string. $ starts a variable reference (usually expanding to empty), a backtick escapes the next character, and a " terminates the string. The local admin account then gets a password that differs from the one Coder shows, or the script fails to parse.
2. Unencoded URL query parameter — main.tf:57
url = "https://localhost:${var.port}${local.web_url_path}?username=${local.admin_username}&password=${var.admin_password}"The credentials go straight into the query string with no urlencode. An & truncates the password, # drops everything after it, + decodes as a space, and a bare % produces an invalid escape.
Either path ends in a failed DCV login, and whether a user hits it depends on which characters their generated password happens to contain, so it presents as a random, hard-to-reproduce failure.
Expected Behavior
The password reaching the DCV login and the password set on the Windows account are both byte-identical to the value shown in the Coder UI, for any character.
Steps to Reproduce
- Add the
amazon-dcv-windows module to a Windows template with admin_password = "Pa$$w&rd"1!"(or anyrandom_passwordthat happens to include$, &, `` ``, ", or `#`).
- Start the workspace and open the Web DCV app.
- Observe the login fails, and that the password in the app URL is truncated or altered compared to the workspace UI.
Desired Solution
Encode each value for its destination, the same approach used for windows-rdp in #1034:
| Destination |
Encoding |
| PowerShell script |
single-quoted string with ' doubled |
| App URL query |
urlencode() on both username and password |
A test asserting the rendered script and app URL round-trip a password containing \ " ' `` `` $ & < > | # % +` would keep this from regressing.
[!NOTE]
Same class of bug as #20, different module, so it needs its own fix and release.
Related to #20
Follow-up for #1034
🤖 This response was generated by Coder Agents.
Current Behavior
The
amazon-dcv-windowsmodule interpolatesadmin_passwordinto two places without escaping it for the target syntax, so passwords containing common special characters silently become a different password.1. PowerShell double-quoted string —
install-dcv.ps1:2$, backtick, and"are all interpreted inside a PowerShell double-quoted string.$starts a variable reference (usually expanding to empty), a backtick escapes the next character, and a"terminates the string. The local admin account then gets a password that differs from the one Coder shows, or the script fails to parse.2. Unencoded URL query parameter —
main.tf:57The credentials go straight into the query string with no
urlencode. An&truncates the password,#drops everything after it,+decodes as a space, and a bare%produces an invalid escape.Either path ends in a failed DCV login, and whether a user hits it depends on which characters their generated password happens to contain, so it presents as a random, hard-to-reproduce failure.
Expected Behavior
The password reaching the DCV login and the password set on the Windows account are both byte-identical to the value shown in the Coder UI, for any character.
Steps to Reproduce
amazon-dcv-windowsmodule to a Windows template withadmin_password = "Pa$$w&rd"1!"(or anyrandom_passwordthat happens to include$,&, ````,", or `#`).Desired Solution
Encode each value for its destination, the same approach used for
windows-rdpin #1034:'doubledurlencode()on both username and passwordA test asserting the rendered script and app URL round-trip a password containing
\ " ' ```` $ & < > | # % +` would keep this from regressing.Related to #20
Follow-up for #1034