[VM] Fix #33979: az vm user update: Fix password parsing so ')' in --password does not break Windows VM password reset

[Aditya Pujara (a0x1ab)]

🤖 PR Validation — ️✔️ All clear

Breaking Changes	Tests
️✔️ None	️✔️ 130/130

Description

Fixes #33979.

On Windows, az vm user update --password 'Test)123' fails with 123 was unexpected at this time. before Python starts. The ) in the password closes the IF EXIST (...) ... ELSE (...) parenthesis block in az.bat, breaking cmd.exe parsing.

Related command
az vm user update

Description

• src/azure-cli/az.bat: Replace the IF EXIST (...) ELSE (...) block—which embeds %* inside parentheses—with a GOTO-based pattern so argument values containing ) (or other cmd.exe metacharacters) never terminate a grouping block:

  IF NOT EXIST "%~dp0\python.exe" GOTO usepath
  "%~dp0\python.exe" -m azure.cli %*
  GOTO end
  :usepath
  python -m azure.cli %*
  :end

• test_custom_vm_commands.py: Add test_reset_windows_admin_special_chars_in_password — mocks VMExtensionCreate and asserts passwords containing ), (, &, |, and ^ reach protected_settings verbatim, confirming the Python-level extension call path does not corrupt special characters.

Testing Guide

On Windows with cmd.exe or PowerShell, the following should now succeed rather than erroring before any Azure API call:

az vm user update -g myRg -n myWinVm --username AzureUser --password "Test)123"

Unit test (offline, no Azure subscription needed):

python -m pytest azure/cli/command_modules/vm/tests/latest/test_custom_vm_commands.py::TestVmCustom::test_reset_windows_admin_special_chars_in_password

History Notes

[VM] az vm user update: Fix ) and other shell metacharacters in --password breaking Windows VM password reset on cmd.exe

[azure-client-tools-agent]

Live test results — azdev test --live --series (changed test files only)

✅ PASS

Selectors: test_custom_vm_commands (module)
PR head ref: agent-assist/azure-azure-cli-issue-33979-ef9e71dface1
PR head sha: bf5119ec1af711f0843a5b5ee8c6e74a154ecd59
PR base ref: dev
New test files in PR: false

Changed test files run

src/azure-cli/azure/cli/command_modules/vm/tests/latest/test_custom_vm_commands.py

Workflow run: https://github.com/Azure/issue-sentinel/actions/runs/32830818633

Last 80 lines of azdev output

=============
| Run Tests |
=============


=====================
| Discovering Tests |
=====================

/home/runner/work/issue-sentinel/issue-sentinel/azure-cli/src/azure-cli/azure/cli/command_modules/vm/tests/latest/test_vm_commands.py:13705: SyntaxWarning: invalid escape sequence '\]'
  self.cmd('vmss application set -g {rg} -n {vmss} --app-version-ids {vid1} {vid2} --enable-automatic-upgrade True\]', checks=[
/home/runner/work/issue-sentinel/issue-sentinel/azure-cli/src/azure-cli/azure/cli/command_modules/identity/tests/latest/test_identity.py:18: SyntaxWarning: invalid escape sequence '\{'
  'resource_restriction_compute': '\{"providers":\["Microsoft.Compute"\]\}',
/home/runner/work/issue-sentinel/issue-sentinel/azure-cli/src/azure-cli/azure/cli/command_modules/identity/tests/latest/test_identity.py:19: SyntaxWarning: invalid escape sequence '\{'
  'resource_restriction_empty': '\{"providers":\[\]\}'

test index updated: /home/runner/.azdev/env_config/home/runner/work/issue-sentinel/issue-sentinel/.venv/test_index/latest.json

Test on modules: test_custom_vm_commands

WARNING: RUNNING TESTS LIVE
The tests are set to run against current profile "latest"
============================= test session starts ==============================
platform linux -- Python 3.12.14, pytest-9.1.1, pluggy-1.6.0 -- /home/runner/work/issue-sentinel/issue-sentinel/.venv/bin/python
cachedir: .pytest_cache
rootdir: /home/runner/work/issue-sentinel/issue-sentinel/azure-cli/src/azure-cli
plugins: forked-1.7.5, xdist-3.8.0
collecting ... collected 8 items

azure-cli/src/azure-cli/azure/cli/command_modules/vm/tests/latest/test_custom_vm_commands.py::TestVmCustom::test_get_access_extension_upgrade_info PASSED [ 12%]
azure-cli/src/azure-cli/azure/cli/command_modules/vm/tests/latest/test_custom_vm_commands.py::TestVmCustom::test_get_extension_instance_name PASSED [ 25%]
azure-cli/src/azure-cli/azure/cli/command_modules/vm/tests/latest/test_custom_vm_commands.py::TestVmCustom::test_get_extension_instance_name_when_type_none PASSED [ 37%]
azure-cli/src/azure-cli/azure/cli/command_modules/vm/tests/latest/test_custom_vm_commands.py::TestVmCustom::test_merge_secrets PASSED [ 50%]
azure-cli/src/azure-cli/azure/cli/command_modules/vm/tests/latest/test_custom_vm_commands.py::TestVmCustom::test_reset_windows_admin_special_chars_in_password PASSED [ 62%]
azure-cli/src/azure-cli/azure/cli/command_modules/vm/tests/latest/test_custom_vm_commands.py::TestVMBootLog::test_vm_boot_log_handle_unicode PASSED [ 75%]
azure-cli/src/azure-cli/azure/cli/command_modules/vm/tests/latest/test_custom_vm_commands.py::TestVMBootLog::test_vm_boot_log_init_storage_sdk PASSED [ 87%]
azure-cli/src/azure-cli/azure/cli/command_modules/vm/tests/latest/test_custom_vm_commands.py::TestVMBootLog::test_vm_boot_log_uses_keys_property PASSED [100%]

- generated xml file: /home/runner/work/issue-sentinel/issue-sentinel/test-output/results.xml -
============================== 8 passed in 0.48s ===============================

Posted by agent-assist live-test workflow.

[Yong Zhang (yonzhan)]

VM

[azure-client-tools-agent]

Aditya Pujara (@a0x1ab)

Upstream CI

All 64 checks passed; no failures to report.

Test validation

• Live test: Passed (azdev test against the changed VM test file, live run).
• Regression coverage: Not applicable — the production change is in src/azure-cli/az.bat, which is outside the azdev/module regression-coverage scope.

Review-skill findings

test-strength — src/azure-cli/azure/cli/command_modules/vm/tests/latest/test_custom_vm_commands.py (new test test_reset_windows_admin_special_chars_in_password, lines 170-198)

The actual bug fix in this PR is entirely in src/azure-cli/az.bat: the previous IF EXIST (...) ELSE (...) block expanded %* inside a parenthesized block, so any argument containing ) (e.g. --password "Test)123") truncated/corrupted the batch script's command line before Python ever ran. The fix replaces the parenthesized IF/ELSE with a GOTO-based branch, which is the correct fix for this class of cmd.exe parsing bug.

However, the new test only exercises _reset_windows_admin in Python and asserts that protected_settings['Password'] is passed verbatim. That code path never went through az.bat and was not affected by the bug — this test would pass identically whether or not the az.bat fix is present or is reverted. It therefore provides no regression protection for the actual defect being fixed, and would not fail if the az.bat change were rolled back or broken again in the future.

Remediation: Since az.bat argument parsing can't be exercised through azdev/pytest, add a narrow platform-specific regression check instead (or explicitly note in the PR description why none is added), for example a Windows CI step that invokes az.bat --version (or a lightweight command) with a )-containing dummy argument via subprocess and asserts the process starts without a batch parsing error. Alternatively, at minimum call out in the PR description that the fix is verified manually on Windows, since the added Python unit test is not evidence the az.bat fix works or continues to work.

Verification: After adding a batch-level check, rerun it locally on Windows (cmd /c az.bat vm user update ... --password "Test)123") to confirm the script no longer breaks on ).

Risk assessment

0/100 · Low · Low confidence

The Low rating reflects the detected change scope with no elevated security, reliability, customer, operational, dependency, sovereign-cloud, generated-output, or cross-component signal.

• Change scope: 2 changed files, 41 changed lines (+36 / -5), including 0 production files.
• Affected components: No production component was identified.
• Risk drivers: No elevated risk signal was detected.
• Regression evidence: No production-code regression-test signal applies.
• Confidence: Low because no production changed-line evidence was available.
• Required review: No additional owning-squad review signal was detected.

[microsoft-github-policy-service]

🔔 Routing this PR to @Azure/act-observability-squad.