Escape the config path in the generated unattend.xml (#64)

Generate-UnattendXML XML-escaped the computer name and the local admin name
but interpolated the embedded Winnow config path raw. A legal path containing
&, < or > produced a malformed autounattend.xml that Windows Setup silently
rejects, so first-boot configuration would just not run. Escape it the same way
as the other two user-supplied values.

Author: BiosSystem

.github/workflows/test.yml

@@ -149,6 +149,15 @@ jobs:
             exit 1
           }
 
+      - name: Run unattend generator tests
+        shell: pwsh
+        run: |
+          $result = Invoke-Pester -Path "Tests/Unit/Test-UnattendGenerator.ps1" -Output Detailed -PassThru
+          if ($result.FailedCount -gt 0) {
+            Write-Error "$($result.FailedCount) test(s) failed in Test-UnattendGenerator.ps1"
+            exit 1
+          }
+
       - name: Run integration tests
         shell: pwsh
         run: |

CHANGELOG.md

@@ -4,6 +4,12 @@ Document all notable Winnow changes in this file. Releases before 4.0.0 were pub
 
 Follow [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Fixed
+
+- Escape the embedded Winnow config path in the generated `autounattend.xml`. `ComputerName` and the local admin name were XML-escaped, but the config path was interpolated raw, so a legal path containing `&`, `<`, or `>` produced a malformed unattend file that Windows Setup silently rejects. All three user-supplied values are now escaped.
+
 ## [4.2.1] - 2026-09-18
 
 ### Fixed

Scripts/Features/UnattendGenerator.ps1

@@ -44,10 +44,13 @@ function Generate-UnattendXML {
     } else { "" }
 
     $winSwiftFirstBoot = if (-not [string]::IsNullOrWhiteSpace($WinnowConfigPath)) {
+        # Escape the path for XML like the other user-supplied values, so a legal path containing
+        # &, < or > does not produce an autounattend.xml that Windows Setup silently rejects.
+        $escapedConfigPath = [System.Security.SecurityElement]::Escape($WinnowConfigPath)
         @"
                 <RunSynchronousCommand wcm:action="add">
                     <Order>2</Order>
-                    <Path>powershell.exe -NonInteractive -ExecutionPolicy Bypass -File "C:\Winnow\Winnow-Standalone.ps1" -Config "$WinnowConfigPath"</Path>
+                    <Path>powershell.exe -NonInteractive -ExecutionPolicy Bypass -File "C:\Winnow\Winnow-Standalone.ps1" -Config "$escapedConfigPath"</Path>
                     <Description>Apply Winnow configuration on first boot</Description>
                 </RunSynchronousCommand>
 "@

Tests/Unit/Test-UnattendGenerator.ps1

@@ -0,0 +1,46 @@
+#Requires -Modules @{ ModuleName = 'Pester'; ModuleVersion = '5.0.0' }
+<#
+.SYNOPSIS
+    Unit tests for the unattend.xml generator, focused on XML-escaping user input.
+.DESCRIPTION
+    ComputerName, LocalAdminName, and the embedded Winnow config path are all user supplied and go
+    into the generated autounattend.xml. Any of them can legally contain & < or >, which must be
+    XML-escaped or Windows Setup silently rejects the file.
+#>
+
+BeforeAll {
+    $repoRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
+    . (Join-Path $repoRoot 'Scripts\Features\UnattendGenerator.ps1')
+
+    function New-UnattendXml {
+        param([hashtable]$Parameters)
+        $out = Join-Path $TestDrive ('unattend-' + [guid]::NewGuid().ToString('N').Substring(0, 8) + '.xml')
+        Generate-UnattendXML @Parameters -OutputPath $out -Confirm:$false 6>$null | Out-Null
+        return $out
+    }
+}
+
+Describe 'Generate-UnattendXML' {
+
+    It 'produces valid XML when the config path contains XML special characters' {
+        $path = New-UnattendXml -Parameters @{ WinnowConfigPath = 'C:\Games & Config\<win>.json' }
+        { [xml](Get-Content -LiteralPath $path -Raw) } | Should -Not -Throw
+    }
+
+    It 'escapes the embedded config path' {
+        $path = New-UnattendXml -Parameters @{ WinnowConfigPath = 'C:\A & B\c.json' }
+        $raw = Get-Content -LiteralPath $path -Raw
+        $raw | Should -Match 'A &amp; B'
+        $raw | Should -Not -Match 'A & B'
+    }
+
+    It 'produces valid XML when the computer name and admin name contain special characters' {
+        $path = New-UnattendXml -Parameters @{ ComputerName = 'PC&1'; LocalAdminName = 'Ad<min>' }
+        { [xml](Get-Content -LiteralPath $path -Raw) } | Should -Not -Throw
+    }
+
+    It 'produces valid XML for the default (no optional inputs)' {
+        $path = New-UnattendXml -Parameters @{}
+        { [xml](Get-Content -LiteralPath $path -Raw) } | Should -Not -Throw
+    }
+}