‘&’ in local account username breaks the generated unattend.xml

[christian8641]

Checklist

• I have been made aware that if my problem can be summarized as "I've created or tried to create a media using Rufus, and ...", and I am not including a log, this issue will be summarily closed.
• I looked at https://github.com/pbatard/rufus/wiki/FAQ to see if my question has already been answered.
• I performed a search in the issue tracker for similar issues using keywords relevant to my problem, such as the error message I got from the log.
• I clicked the 'Log' button (🗒️) or pressed Ctrl-L in Rufus, or used DebugView, and copy/pasted the log into the section that says <FULL LOG> below.
• The log I am copying is the FULL log, starting with the line Rufus version: x.y.z - I have NOT removed any part of it.

Issue description

Same kind of source bug as #2984, also in src/wue.c. No useful log: the
Rufus run completes without error. The problem is in the generated
unattend.xml (attached).

A '&' in the local account username is written into the XML as-is, but XML
requires &. The file is then not valid XML.

Why it gets through:

• src/stdlg.c line 849 replaces /\[]:;|=,+*?<>"
• src/wue.c line 352 filters /\[]:|<>+=;,?*%@.

Neither catches '&', and per the Microsoft doc linked at line 350, '&' is
allowed in account names. The username is written unescaped into <Name> and
<DisplayName> (lines 362-363) and the net user command (line 380). Line 396
already escapes && as &&, so this looks like the only spot missing it.

Tested with Rufus , Windows 11 ISO, username "test & test": media
creation succeeds, the install runs through the phase that needs the USB,
then fails with an error. OK reboots, same error again - it never completes.
Short username without &, same ISO, same VM: installs fine.

Fix: escape '&' as & when writing the username (like line 396), or add
'&' to the filter lists (simpler, but blocks a character Windows allows).
The <TimeZone> at line 340 is written unescaped too - probably never an
issue with real timezone names, but same pattern.

Log

No log - the run completes without error, the bug is in the attached
unattend.xml

unattend.xml

[pbatard]

Thanks for the report. I am just going to filter out the use of & as part of a username. Sorry but, even as it is officially accepted, the cost/benefit of escaping & into & is just not worth it.