cloudstack-setup-databases doesn't parse password input properly

Start at the cloudstack-setup-databases entry point and trace how the password is assembled for EncryptionCLI and passed through /bin/sh. Reproduce with the provided password containing $, then verify that the decrypted value remains intact and that other special characters mentioned in the issue are handled correctly.

problem

While running cloudstack-setup-databases, if it is called with any password containing a $, the password gets truncated at the $ before being passed to EncryptionCLI, thus storing an incorrect encrypted password in db.properties.

versions

This was discovered while executing cloudstack-setup-databases on a clean install of 4.23.

The steps to reproduce the bug

1. Call cloudstack-setup-databases cloud:'pa$sword'@localhost --deploy-as=root:'pa$sword'
2. Decrypt what was stored in db.properties and note the output is only pa:

# java -classpath /usr/share/cloudstack-common/lib/cloudstack-utils.jar com.cloud.utils.crypt.EncryptionCLI -d -i "4dfIlH8M/ydVp+mYjIBr7S1plQDzsOzmKt2jAeGW" -p "password"
pa

What to do about it?

This seems to be a parsing issue in cloudstack-setup-databases. The password is getting to the script correctly because it is able to us it in mysql with mysqlCmds.append('--password=\'%s\''%kwargs['passwd']) and this part of the script succeeds.

But then when it assembles the encrypt command to go to the CLI, it wraps that password in double quotes:
cmd = ['java','-classpath','"' + self.encryptionJarPath + '"','com.cloud.utils.crypt.EncryptionCLI','-i','"' + value + '"', '-p', '"' + self.mgmtsecretkey + '"', self.encryptorVersion]

and then sends it through /bin/sh here (shell=True):
subprocess.Popen(' '.join(cmds), shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)

In doing so, sh will expand the variable $sword to nothing. I haven't tested, but presumably things like \, ", and ' might also be a problem.