cloud-setup-databases: shell-escape values passed to EncryptionCLI

[jdscreations]

Description

processEncryptionStuff()'s encrypt() builds the java ... EncryptionCLI command by hand-wrapping each dynamic value (jar path, value to encrypt, management server secret key) in literal double quotes, then hands the space-joined string to runCmd(), which runs it via subprocess.Popen(' '.join(cmds), shell=True, ...).

Double quotes do not stop the shell from expanding "$..." inside them. So a password containing $ — e.g. pa$sword — is silently truncated to pa by the shell before it ever reaches EncryptionCLI, and the wrong value gets encrypted into db.properties. This matches the exact behavior reported in the issue (decrypting what was stored yields pa, not pa$sword).

Fix: use shlex.quote() instead of the manual double-quote wrapping, for all three dynamic values passed into the command list. shlex.quote() produces shell-safe quoting for arbitrary values, including but not limited to $.

I kept the change scoped to encrypt() — the other runCmd() caller for passwords (mysqlCmds, ~line 160) already uses single quotes ('--password=\'%s\''), which correctly prevents shell expansion, so that path isn't affected by this bug and I left it untouched.

Fixes: #14186

Types of changes

• Bug fix (non-breaking change which fixes an issue)

Feature/Enhancement Scale or Bug Severity

Bug Severity

• Major

How Has This Been Tested?

The full script is a .in template requiring the CloudStack build (waf/Maven) to substitute @COMMONLIBDIR@/@PYTHONDIR@ and produce a runnable executable, and EncryptionCLI itself lives in cloudstack-utils.jar. Rather than standing up the full build, I isolated the actual bug — shell quoting through runCmd()'s shell=True pattern — in a standalone reproduction that shells out exactly the same way, substituting a trivial stand-in for the Java program so the arguments it actually receives are directly observable:

=== OLD (double-quote wrapping) ===
'pa\npa\n'          # password 'pa$sword' arrives truncated to 'pa'

=== NEW (shlex.quote) ===
'pa$sword\npa$sword\n'   # password arrives intact

Also verified python3 -m py_compile setup/bindir/cloud-setup-databases.in passes (valid Python syntax) and confirmed the same bug is present on this branch (4.22) prior to the fix.

How did you try to break this feature and the system with this change?

shlex.quote() is the standard-library-correct way to safely pass arbitrary strings through a shell=True invocation — it handles $, single quotes, backticks, semicolons, and whitespace generically, not just the $ case in the report. Checked the other three runCmd() call sites in this file (mysql invocation, build-classpath, DatabaseConfig) to confirm none of them pass user-controlled dynamic values needing the same treatment, and none were touched by this change.

[boring-cyborg]

Congratulations on your first Pull Request and welcome to the Apache CloudStack community! If you have any issues or are unsure about any anything please check our Contribution Guide (https://github.com/apache/cloudstack/blob/main/CONTRIBUTING.md)
Here are some useful points:

• In case of a new feature add useful documentation (raise doc PR at https://github.com/apache/cloudstack-documentation)
• Be patient and persistent. It might take some time to get a review or get the final approval from the committers.
• Pay attention to the quality of your code, ensure tests are passing and your PR doesn't have conflicts.
• Please follow ASF Code of Conduct for all communication including (but not limited to) comments on Pull Requests, Issues, Mailing list and Slack.
• Be sure to read the CloudStack Coding Conventions.
  Apache CloudStack is a community-driven project and together we are making it better 🚀.
  In case of doubts contact the developers at:
  Mailing List: dev@cloudstack.apache.org (https://cloudstack.apache.org/mailing-lists.html)
  Slack: https://apachecloudstack.slack.com/