bug: special characters in amazon-dcv-windows admin_password break DCV login

[matifali]

Current Behavior

The amazon-dcv-windows module interpolates admin_password into two places without escaping it for the target syntax, so passwords containing common special characters silently become a different password.

1. PowerShell double-quoted string — install-dcv.ps1:2

$adminPassword = "${admin_password}"

$, backtick, and " are all interpreted inside a PowerShell double-quoted string. $ starts a variable reference (usually expanding to empty), a backtick escapes the next character, and a " terminates the string. The local admin account then gets a password that differs from the one Coder shows, or the script fails to parse.

2. Unencoded URL query parameter — main.tf:57

url = "https://localhost:${var.port}${local.web_url_path}?username=${local.admin_username}&password=${var.admin_password}"

The credentials go straight into the query string with no urlencode. An & truncates the password, # drops everything after it, + decodes as a space, and a bare % produces an invalid escape.

Either path ends in a failed DCV login, and whether a user hits it depends on which characters their generated password happens to contain, so it presents as a random, hard-to-reproduce failure.

Expected Behavior

The password reaching the DCV login and the password set on the Windows account are both byte-identical to the value shown in the Coder UI, for any character.

Steps to Reproduce

1. Add the amazon-dcv-windows module to a Windows template with admin_password = "Pa$$w&rd"1!"(or anyrandom_passwordthat happens to include$, &, `` ``, ", or `#`).
2. Start the workspace and open the Web DCV app.
3. Observe the login fails, and that the password in the app URL is truncated or altered compared to the workspace UI.

Desired Solution

Encode each value for its destination, the same approach used for windows-rdp in #1034:

Destination	Encoding
PowerShell script	single-quoted string with ' doubled
App URL query	urlencode() on both username and password

A test asserting the rendered script and app URL round-trip a password containing \ " ' `` `` $ & < > | # % +` would keep this from regressing.

Note

Same class of bug as #20, different module, so it needs its own fix and release.

Related to #20
Follow-up for #1034

🤖 This response was generated by Coder Agents.

[linear-code]

ENG-3112