Fix: Double encoding of URLs when using data proxy (#98494)

fix: unescape raw path and set to req path

pkg/api/pluginproxy/ds_auth_provider.go

@@ -32,7 +32,6 @@ func ApplyRoute(ctx context.Context, req *http.Request, proxyPath string, route
 	}
 
 	ctxLogger := logger.FromContext(ctx)
-
 	if len(route.URL) > 0 {
 		interpolatedURL, err := interpolateString(route.URL, data)
 		if err != nil {
@@ -49,7 +48,14 @@ func ApplyRoute(ctx context.Context, req *http.Request, proxyPath string, route
 		req.URL.Scheme = routeURL.Scheme
 		req.URL.Host = routeURL.Host
 		req.Host = routeURL.Host
-		req.URL.Path = util.JoinURLFragments(routeURL.Path, proxyPath)
+		req.URL.RawPath = util.JoinURLFragments(routeURL.Path, proxyPath)
+		unescapedPath, err := url.PathUnescape(req.URL.RawPath)
+		if err != nil {
+			ctxLogger.Error("Failed to unescape raw path", "rawPath", req.URL.RawPath, "error", err)
+			return
+		}
+
+		req.URL.Path = unescapedPath
 	}
 
 	if err := addQueryString(req, route, data); err != nil {

pkg/api/pluginproxy/ds_proxy_test.go

@@ -119,6 +119,10 @@ func TestDataSourceProxy_routeRule(t *testing.T) {
 				Path:      "api/rbac-restricted",
 				ReqAction: "test-app.settings:read",
 			},
+			{
+				Path: "encodedPath",
+				URL:  "http://encoded.com",
+			},
 		}
 
 		ds := &datasources.DataSource{
@@ -235,6 +239,16 @@ func TestDataSourceProxy_routeRule(t *testing.T) {
 			assert.Equal(t, "https://example.com/api/v1/some-route/", req.URL.String())
 		})
 
+		t.Run("When matching proxy path is already encoded", func(t *testing.T) {
+			ctx, req := setUp()
+			proxy, err := setupDSProxyTest(t, ctx, ds, routes, "/our%20devices")
+			require.NoError(t, err)
+			proxy.matchedRoute = routes[9]
+			ApplyRoute(proxy.ctx.Req.Context(), req, proxy.proxyPath, proxy.matchedRoute, dsInfo, proxy.cfg)
+
+			assert.Equal(t, "http://encoded.com/our%20devices", req.URL.String())
+		})
+
 		t.Run("Validating request", func(t *testing.T) {
 			t.Run("plugin route with valid role", func(t *testing.T) {
 				ctx, _ := setUp()