[BUG] Client command should urlencode password

[mogul]

Description

GIVEN the broker is serving based on the password from the SECURITY_USER_PASSWORD environment variable
AND the SECURITY_USER_PASSWORD contains a URL-sensitive symbol such as %
WHEN I run cloud-service-broker client catalog...

Expected Behavior

...THEN I should see the catalog command complete successfully

Actual Behavior

...BUT instead I see

2021/03/29 18:54:57 Could not create API client: parse "http://f9a544d5-0fe9-90cd-5e4c-8bc9b3a2e4fa:M*P2JFDsE3i@[+zX@localhost:8080/v2/": net/url: invalid userinfo

Possible Fix

The password should be URL-encoded before generating the client URL string here:
https://github.com/cloudfoundry-incubator/cloud-service-broker/blob/82ec90df2e9d5c9b8f3a49e87d40f9401bfc4d97/pkg/client/client.go#L51

Steps to Reproduce

1. Get CSB running with a valid configuration.
2. Set the password to one with a % in it.
3. Run cloud-service-broker serve
4. Run cloud-service-broker client catalog

Context

We run the CSB as a Cloud Foundry app. Sometimes CF and the CSB get out of sync when a binding operations times out and we need to manually clean up service instances. On the CF side, we do cf purge-service-instance. Then we cf ssh into the CSB application, and run cloud-service-broker client [unbind|deprovision] .... If the password that was used for the app includes a % you get confusing Not authorized responses even though you're using the exact same password that the CSB is pulling from the environment when CF ran cloud-service-broker serve as a startup command. You have to know that the password needs to be url-encoded before it can be used by the client command, and take the extra step to urlencode it yourself.

Your Environment

• Version used: latest
• Operating System and version (desktop): N/A
• Link to your project (if public): https://github.com/GSA/datagov-ssb
• Platform (Azure/AWS/GCP): N/A
• Applicable Services: N/A

[cf-gitbot]

We have created an issue in Pivotal Tracker to manage this:

https://www.pivotaltracker.com/story/show/177548318

The labels on this github issue will be updated when the story is started.