net/url: proxy settings will be ignored when user credentials have a % sign in it

[alexal]

What version of Go are you using (go version)?

$ go version
go version go1.14 darwin/amd64

Does this issue reproduce with the latest release?

Yes.

What operating system and processor architecture are you using (go env)?

go env Output

GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/Users/alex/Library/Caches/go-build"
GOENV="/Users/alex/Library/Application Support/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOINSECURE=""
GONOPROXY=""
GONOSUMDB=""
GOOS="darwin"
GOPATH="/Users/alex/Dev/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/Cellar/go/1.14/libexec"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/Cellar/go/1.14/libexec/pkg/tool/darwin_amd64"
GCCGO="gccgo"
AR="ar"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD="/Users/alex/Dev/Google/go/src/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/zb/5rqszm5s2yj47f8sg4bbxpsw0000gn/T/go-build737108313=/tmp/go-build -gno-record-gcc-switches -fno-common"

What did you do?

Set HTTP_PROXY to http://test:tes%t:server.com and tried to read http://google.com

package main

import (
	"fmt"
	"net/http"
	"net/url"
	"os"
	"time"
)

func main() {
	cli := http.Client{Transport: &http.Transport{Proxy: http.ProxyFromEnvironment}, Timeout: 2 * time.Second}
	_, err := cli.Get("https://google.com")
	if err != nil {
		fmt.Println(err)
	} 
	fmt.Printf("The end")
}

What did you expect to see?

A connection to http://google.com via the proxy server.

What did you see instead?

Proxy settings were ignored. A connection to http://google.com didn't use a proxy server.

Everything works fine when the user credentials don't have a % sign.

[alexal]

I spent a bit more time investigating the problem and I would change my initial statement. The problem starts with the unescape function while parsing user authority.

Should an additional validation be added in unescape function for encodeUserPassword?

If yes, then probably shouldEscape function also needs to be updated.

[maksim77]

In fact, the problem is not so much the percentage symbol. The main difficulty is that the environment variable can contain any string. So that there is no error there will not be.

[seankhliao]

I understand this to be invalid input, the RFCs we follow dictate that the urls need to be escaped to be parsed unambiguously.