Auth Proxy: encoding of non-ASCII headers (#44797)

* Decode auth proxy headers using URL encoding

* Header encoding configuration via settings file

* Rename configuration setting to headers_encoded

* Quoted-printable encoding

* Tests for AuthProxy

* Fix encoding name

* Remove authproxy init

pkg/util/encoding.go

@@ -6,6 +6,8 @@ import (
 	"encoding/base64"
 	"encoding/hex"
 	"errors"
+	"io"
+	"mime/quotedprintable"
 	"strings"
 
 	"golang.org/x/crypto/pbkdf2"
@@ -71,3 +73,12 @@ func RandomHex(n int) (string, error) {
 	}
 	return hex.EncodeToString(bytes), nil
 }
+
+// decodeQuotedPrintable decodes quoted-printable UTF-8 string
+func DecodeQuotedPrintable(encodedValue string) string {
+	decodedBytes, err := io.ReadAll(quotedprintable.NewReader(strings.NewReader(encodedValue)))
+	if err != nil {
+		return encodedValue
+	}
+	return string(decodedBytes)
+}

pkg/util/encoding_test.go

@@ -32,3 +32,73 @@ func TestEncodePassword(t *testing.T) {
 		encodedPassword,
 	)
 }
+
+func TestDecodeQuotedPrintable(t *testing.T) {
+	t.Run("should return not encoded string as is", func(t *testing.T) {
+		testStrings := []struct {
+			in  string
+			out string
+		}{
+			{"", ""},
+			{"  ", ""},
+			{"munich", "munich"},
+			{" munich", " munich"},
+			{"munich gothenburg", "munich gothenburg"},
+			{"München", "München"},
+			{"München Göteborg", "München Göteborg"},
+		}
+
+		for _, str := range testStrings {
+			val := DecodeQuotedPrintable(str.in)
+			assert.Equal(t, str.out, val)
+		}
+	})
+
+	t.Run("should decode encoded string", func(t *testing.T) {
+		testStrings := []struct {
+			in  string
+			out string
+		}{
+			{"M=C3=BCnchen", "München"},
+			{"M=C3=BCnchen G=C3=B6teborg", "München Göteborg"},
+			{"=E5=85=AC=E5=8F=B8", "公司"},
+		}
+
+		for _, str := range testStrings {
+			val := DecodeQuotedPrintable(str.in)
+			assert.Equal(t, str.out, val)
+		}
+	})
+
+	t.Run("should gracefully ignore invalid encoding sequences", func(t *testing.T) {
+		testStrings := []struct {
+			in  string
+			out string
+		}{
+			{"=XY=ZZ", "=XY=ZZ"},
+			{"==58", "=X"},
+			{"munich = gothenburg", "munich = gothenburg"},
+			{"munich == tromso", "munich == tromso"},
+		}
+
+		for _, str := range testStrings {
+			val := DecodeQuotedPrintable(str.in)
+			assert.Equal(t, str.out, val)
+		}
+	})
+
+	t.Run("should return invalid UTF-8 sequences as is", func(t *testing.T) {
+		testStrings := []struct {
+			in  string
+			out string
+		}{
+			{"=E5 =85=AC =E5=8F =B8", "\xE5 \x85\xAC \xE5\x8F \xB8"},
+			{"=00=00munich=FF=FF", "\x00\x00munich\xFF\xFF"},
+		}
+
+		for _, str := range testStrings {
+			val := DecodeQuotedPrintable(str.in)
+			assert.Equal(t, str.out, val)
+		}
+	})
+}