Environment variable with %18 in the value breaks appcmd

[erenes]

One automatically generated password that is set in an environment variable in a container accidentally contained the sequence %18.

This resulted in the following appcmd command:

C:\Windows\system32\inetsrv\appcmd.exe set config -section:system.applicationHost/applicationPools /+"[name='DefaultAppPool'].environmentVariables.[name='MY_ENV_VAR',value='%18']" /commit:apphost

The result of which is:

ERROR ( hresult:c00cee2b, message:Failed to commit configuration changes.
 )

When using %64 it "works", resulting in a value of 'd' in the configuration, it seems clear that %## is interpreted as an ascii hex code. When using %25, I get a percent-sign in the value, as "expected".

I think a % value should be escaped (as %25 perhaps, maybe there's another escape sequence available?) while passing it to appcmd.

Note: Error code 0xc00cee2b is "WC_E_XMLCHARACTER".

[victor-makovsky-covergo]

Same problem here:
When there is an environment variable with characters like "%14", ServiceMonotor.exe fails with the following error message:

APPCMD failed with error code -1072894421
Failed to update IIS configuration