Percent-encoded container names: Go routes on the decoded path, Rust/TS on the raw path #53

Problem

The three implementations disagree about percent-encoded paths. In all three, the router and the daemon can read a request differently:

• Go: the handler routes on r.URL.Path (go/internal/proxy/handler.go:53), which is percent-decoded. DELETE /containers/%2F becomes /containers//, the name is empty, and the request is denied (post-Rust extract_container_name treats empty segment as a container name (DELETE /containers/ is forwarded) #48). DELETE /v%D9%A1/containers/foo reaches the router as /v١/…; it was allowed before Go/Rust strip any /v…/ first segment as an API version (/volumes/… routed as a container action) #57.
• Rust: hyper's uri.path() is raw, so the name is the literal %2F. Rust treats that as an unknown container, allows the request and forwards it.
• TypeScript: Node's req.url is raw. Same outcome as Rust (checked against built ts/dist: DELETE /containers/%2F → Allow).

The daemon percent-decodes on its own side. So what Rust and TS forward as "a container named %2F", the daemon reads as a request about /.

Evidence: what a real client sends (Docker CLI 29.4.0, wire capture)

• % appears in the query string all the time: ps --filter → ?filters=%7B%22label%22…, cp → ?path=%2Ftmp%2Fa+b%25c, tag → ?repo=localhost%3A5000%2Fx%2Fy.
• % appears in the path only for names that need escaping. Container and volume names are restricted to [a-zA-Z0-9][a-zA-Z0-9_.-] (the daemon rejects a b). Image references, including :tag@sha256:… and registry:port/…, are sent unescaped, and docker rm a/b sends a raw /.
• Network names are the exception: the daemon accepts a b and net%x, and the CLI sends GET|DELETE /networks/a%20b.

Proposed solution (decided)

Deny any request whose raw path contains %, for every method, GET included. The check looks only at the path, after the query string is removed, so encoded query strings are unaffected. It runs first in Router.route, before the API-version strip and the GET passthrough, in all three languages.

• Go: the handler routes on r.URL.EscapedPath() instead of the decoded r.URL.Path. Without a %, the two are identical. Go's re-encoding of raw non-ASCII bytes also gets denied, which fails closed.
• Rust / TS: add the check on the raw path they already route on.
• Spec: spec/router.qnt gains a daemon-decoding table and a routerSeesWhatDaemonSees property: any path the router does not deny reads the same before and after decoding. A router_pre53 instance records that the property fails when % is allowed.
• Tests:
  • Router rows: %2F, %6A%73%6F%6E (json), lowercase %2f, beacon%2Fstart, after a version strip, an encoded version segment, and GET.
  • Handler tests in all three, sending encoded requests through the full handler and checking whether they are forwarded, including an encoded query that must still be forwarded.
  • Integration: DELETE /containers/%2F → 403, and a GET with an encoded query → 200.
  • Row names are shared between the spec and the language tests.

On-the-wire change (Status: Break Change): GET/DELETE /networks/<name> for network names containing spaces or % now get 403 through the proxy.

Alternatives considered

• Route on the decoded path in all three, as Go does today. Rejected. Decoding is where the proxy and daemon interpretations drift (%2F splitting segments, encoded reserved words such as %6A%73%6F%6E = json, encoded version segments). Every decoding rule would need to match the daemon's exactly. No legitimate container or image path needs %, so refusing it removes the whole class.
• Deny % only for non-GET. Rejected. GET is let through without inspecting the path, so encoded GETs add no direct privilege. But "no % in the path" with no exceptions is easier to state, audit and model, and the only cost is network names with spaces or %.
• Leave it documented. Rejected. Go router doesn't exclude reserved path segments in extractContainerName (cross-language parity) #24, Rust extract_container_name treats empty segment as a container name (DELETE /containers/ is forwarded) #48 and Go/Rust strip any /v…/ first segment as an API version (/volumes/… routed as a container action) #57 set the precedent that routing divergences get fixed.

Which implementation(s) would this affect?

• Go (handler routes on the escaped path; router check)
• Rust
• TypeScript
• Quint specification (spec/router.qnt)