From bae12e1f0b305e9588a4ea04f48f21b6277c30f0 Mon Sep 17 00:00:00 2001
From: Charlie Voiselle <464492+angrycub@users.noreply.github.com>
Date: Fri, 6 Dec 2024 08:16:05 -0500
Subject: [PATCH] fix: remove backtick from valid password characters (#15756)

Since backticks are the PowerShell escape character, they are silently
consumed. To actually use backticks, they would need to be doubled when
used.

This change increases the safety of generated passwords for other
terraform modules that might use this value unawares.
---
 examples/templates/azure-windows/main.tf | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/examples/templates/azure-windows/main.tf b/examples/templates/azure-windows/main.tf
index e494b037f7..6b8b00ccca 100644
--- a/examples/templates/azure-windows/main.tf
+++ b/examples/templates/azure-windows/main.tf
@@ -65,9 +65,9 @@ resource "random_password" "admin_password" {
   length  = 16
   special = true
   # https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements#reference
-  # we remove characters that require special handling in XML, as this is how we pass it to the VM
-  # namely: <>&'"
-  override_special = "~!@#$%^*_-+=`|\\(){}[]:;,.?/"
+  # we remove characters that require special handling in XML, as this is how we pass it to the VM; we also remove the powershell escape character
+  # namely: <>&'`"
+  override_special = "~!@#$%^*_-+=|\\(){}[]:;,.?/"
 }
 
 locals {