Parameter escape allows running arbitrary commands and commands fail with valid strings

[MattJeanes]

There appears to be an issue validating some strings in various commands for example when passing the string !#$%&calc as an argument. Any string ending in < also causes issues in commands.

These issues only appear to happen in a Powershell shell, I am unable to reproduce in a cmd shell. I discovered this after one of our passwords for sql db import resulted in a The system cannot find the file specified error so we have had to change the password for now to work around the issue, but this definitely doesn't seem like correct behaviour to me.

To Reproduce:

• Open Powershell prompt (5.1)
• az sql db import -p "!#$%&calc"
• Calculator opens
• az webapp get --name "!#$%&calc"
• Calculator opens
• az webapp get --name "xxxxx^<"
• The syntax of the command is incorrect.
C:\Users\matt> "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\wbin\\..\python.exe" -IBm azure.cli webapp get --name xxxxx<

Expected Behavior

• Calculator does not open
• Commands do not fail

Environment Summary

Windows-10-10.0.17763-SP0
Python 3.6.6
Shell: powershell.exe

azure-cli 2.0.75

Additional Context

[Juliehzl]

cc @AzureAppServiceCLI @antcp

[panchagnula]

This is not specific for Webapps command please see description to see that this happens with az sql as well. The issue is CLI is being used in PowerShell . please use a BASH window. Removing App service label.

[jiasli]

Thanks for elaborating the symptom. You are hitting a known issue in PowerShell which we have doc'ed at: https://github.com/Azure/azure-cli/blob/dev/doc/use_cli_effectively.md#quoting-issues

PowerShell strips double quotes and causes the command to be parsed by CMD as:
az sql db import -p "!#$%&calc" -> az sql db import -p !#$% & calc
where & stands for a command separator.

Same for
az webapp get --name "xxxxx^<" -> az webapp get --name xxxxx^ <
where < stands for stdin redirection.

Please use --% to bypass the bug in PowerShell.

> az --% sql db import -p "!#$%&calc" --debug
Command arguments: ['sql', 'db', 'import', '-p', '!#$%&calc', '--debug']

> az --% webapp get --name "xxxxx^<" --debug
Command arguments: ['webapp', 'get', '--name', 'xxxxx^<', '--debug']