bug: special characters in local-windows-rdp password break the setup script and app URL

[matifali]

Current Behavior

The local-windows-rdp module interpolates var.password into two places without escaping it for the target syntax. With a password containing common special characters, the startup script fails to parse and the app URL is corrupted.

1. PowerShell double-quoted string — configure-rdp.ps1:97

$password = "${password}"

$, backtick, and " are interpreted inside a PowerShell double-quoted string. Observed on a live AWS Windows workspace with password = "Te\st$Pa\"ss'word&<>|1!", the whole Configure RDP` script aborts before it does anything:

The string is missing the terminator: '.
    + CategoryInfo          : ParserError: (:) [], ParentContainsErrorRecordException
    + FullyQualifiedErrorId : TerminatorExpectedAtEndOfString

The workspace then reports start_error and the admin password is never set.

2. Unencoded URL query parameter — main.tf:75

url = "coder://${local.server_name}/v0/open/ws/${data.coder_workspace.me.name}/agent/${var.agent_name}/rdp?username=${var.username}&password=${var.password}"

The credentials go straight into the query string with no urlencode. The rendered app URL on the same workspace was:

coder://dev.coder.com/v0/open/ws/reg37-rdp/agent/main/rdp?username=Administrator&password=Te\st$Pa"ss'w`ord&<>|1!

The password truncates at the first &, so Coder Desktop receives Te\st$Pa"ss'word. A #would drop everything after it,+decodes as a space, and a bare%` is an invalid escape.

Expected Behavior

The password set on the Windows account and the password handed to Coder Desktop are both byte-identical to var.password, for any character.

Steps to Reproduce

1. Use the local-windows-rdp module on a Windows workspace with password = "Te\st$Pa\"ss'word&<>|1!"`.
2. Start the workspace.
3. The Configure RDP script fails with the parser error above, and the Open RDP app URL is truncated at the &.

Desired Solution

Encode each value for its destination, the same approach used for windows-rdp in #1034:

Destination	Encoding
PowerShell script	single-quoted string with ' doubled
App URL query	urlencode() on both username and password

A test asserting the rendered script and app URL round-trip a password containing \ " ' `` `` $ & < > | # % +` would keep this from regressing.

Note

Third module with this bug class, after #20 (windows-rdp) and #1035 (amazon-dcv-windows). Found while dogfooding the fix in #1034 on a real AWS Windows workspace.

Related to #20, #1035
Follow-up for #1034

🤖 This response was generated by Coder Agents.

[linear-code]

ENG-3154