Issue with Escaping Passwords Containing Special Characters When Using rabbitmqctl.bat (RabbitMQ 3.10.6)

[moerwald]

I encountered an issue when trying to add a user with a password containing special characters using rabbitmqctl.bat in RabbitMQ version 3.10.6 (Erlang version 25). The command fails with errors indicating that parts of the password are being interpreted incorrectly by the shell.

Reproduction steps

1. Open PowerShell.
2. Set a password containing special characters. Example:

$username = "testUser6"
$password = 'w63pnZ&LnYMO(t'

3. Attempt to add the user using the following command:

Start-Process -FilePath "rabbitmqctl.bat" -ArgumentList "add_user $username $password" -NoNewWindow -Wait

I have tried escaping the special characters and quoting the password, but the issue persists. Here are the approaches I tried:

Escaping characters in PowerShell:

$escapedPassword = $password -replace '([&^<>"!|()])', '^$1'
$quotedPassword = "`"$escapedPassword`""
Start-Process -FilePath "cmd.exe" -ArgumentList "/c rabbitmqctl.bat add_user $username $quotedPassword" -NoNewWindow -Wait

This results in the same error.

Modifying the batch script to handle the escaped characters did not resolve the issue.

System Information:

RabbitMQ Version: 3.10.6
Erlang Version: 25

Expected behavior

The user should be added successfully, regardless of the special characters in the password.

Actual Behavior:

The command fails with an error indicating that parts of the password are not being interpreted correctly:

Der Befehl "LnYMO" ist entweder falsch geschrieben oder konnte nicht gefunden werden.

Workaround Attempts:

Didn't found anyone.

Additional Context:

The issue appears to be related to how the shell interprets special characters in the password string when passed to the batch file. This issue significantly affects the usability of rabbitmqctl.bat for managing users with complex passwords, which is a common security requirement.

Any guidance or fixes to handle passwords with special characters would be greatly appreciated.

[mkuratczyk]

Please start by testing 3.13/OTP26.
https://www.rabbitmq.com/release-information

[moerwald]

I'll try. Any additional hints? Are there any special characters that are actually not supported?

[lukebakken]

I converted your issue to a Discussion because there is no evidence, yet, that there is a bug in rabbitmqctl.bat. Shell quoting on Windows is a nightmare.

I suggest you use PowerShell and the HTTP API to add users. I will put together an example if I can find the time.

https://rawcdn.githack.com/rabbitmq/rabbitmq-server/v3.13.3/deps/rabbitmq_management/priv/www/api/index.html

[lukebakken]

Another suggestion - use echoargs.exe and set echo on in rabbitmqctl.bat to see what is actually being passed to erl.exe.

Like I said, I'll try to find time to put some examples together in this repo:
https://github.com/lukebakken/rabbitmq-server-11432

[lukebakken]

@moerwald please see the scripts I have added here:

https://github.com/lukebakken/rabbitmq-server-11432

This will start RabbitMQ 3.13.3 locally:

https://github.com/lukebakken/rabbitmq-server-11432/blob/main/run-rabbitmq-server.ps1

This will attempt to add a user with special chars in the password. Notice that it uses echoargs.exe to show what is being passed, so ensure that is in your PATH:

https://github.com/lukebakken/rabbitmq-server-11432/blob/main/add-user.ps1

You'll notice that it is the & character that gets interpreted as a special character by cmd.exe:

Arg 0 is <C:\Users\lbakken\development\lukebakken\rabbitmq-server-11432\rabbitmq_server-3.13.3\sbin\rabbitmqctl.bat>
Arg 1 is <add_user>
Arg 2 is <testUser6>
Arg 3 is <w63pnZ&LnYMO(t>

Command line:
"C:\Users\lbakken\scoop\apps\echoargs\current\echoargs.exe"  C:\Users\lbakken\development\lukebakken\rabbitmq-server-11432\rabbitmq_server-3.13.3\sbin\rabbitmqctl.bat add_user testUser6 w63pnZ&LnYMO(t

Arg 0 is <C:\Users\lbakken\scoop\apps\erlang\current\bin\erl.exe>
Arg 1 is <+B>
Arg 2 is <-boot>
Arg 3 is <start_clean>
Arg 4 is <-noinput>
Arg 5 is <-noshell>
Arg 6 is <-hidden>
Arg 7 is <-smp>
Arg 8 is <enable>
Arg 9 is <-kernel>
Arg 10 is <inet_dist_listen_min>
Arg 11 is <35672>
Arg 12 is <-kernel>
Arg 13 is <inet_dist_listen_max>
Arg 14 is <35682>
Arg 15 is <-run>
Arg 16 is <escript>
Arg 17 is <start>
Arg 18 is <-escript>
Arg 19 is <main>
Arg 20 is <rabbitmqctl_escript>
Arg 21 is <-extra>
Arg 22 is <C:\Users\lbakken\development\lukebakken\rabbitmq-server-11432\rabbitmq_server-3.13.3\escript\rabbitmqctl>
Arg 23 is <add_user>
Arg 24 is <testUser6>
Arg 25 is <w63pnZ>

Command line:
"C:\Users\lbakken\scoop\apps\echoargs\current\echoargs.exe"   "C:\Users\lbakken\scoop\apps\erlang\current\bin\erl.exe" +B -boot start_clean -noinput -noshell -hidden -smp enable  -kernel inet_dist_listen_min 35672 -kernel inet_dist_listen_max 35682 -run escript start -escript main rabbitmqctl_escript -extra "C:\Users\lbakken\development\lukebakken\rabbitmq-server-11432\rabbitmq_server-3.13.3\escript\rabbitmqctl" add_user testUser6 w63pnZ

Adding user "testUser6" ...

I'm continuing to investigate. I will add a add-user-http.ps1 script to show how to add via the HTTP API.

[lukebakken]

@moerwald - well, that was easy. All you have to do is use double quotes inside the single quoted string:

lukebakken/rabbitmq-server-11432@e3dbc49

[moerwald]

Thx for the fast help.

[lukebakken]

@moerwald - here's how I found PowerShell scripts to work with RabbitMQ:

https://www.google.com/search?q=powershell+rabbitmq+HTTP+api

https://stackoverflow.com/questions/29403042/using-powershell-to-create-user-in-rabbitmq-via-api

https://stackoverflow.com/a/29420028

https://github.com/mariuszwojcik/RabbitMQTools

[michaelklishin]

The doc guide that explains how to add users using rabbitmqctl add_user has had this warning for a few years now (that I recall).

[moerwald]

Thx, would be great if the doc guide would be extended, describing how to use passwords with special characters in powershell.

[lukebakken]

@moerwald rather than asking someone else to do the work, you should show your appreciation for the fast support in this discussion by opening a pull request to expand the example commands shown here:

https://github.com/rabbitmq/rabbitmq-website/blob/main/docs/access-control.md?plain=1#L217-L232

[lukebakken]

Well, I decided to get going on it - rabbitmq/rabbitmq-website#1947