fix: drop path normalization to MERGE_SLASHES to allow apps to handle encoded slashes

[Racer159]

Description

PR to address DECODE_AND_MERGE_SLASHES causing issues in certain applications. Gives the ability to selectively turn this off in a namespace with the UDSPackage CR.

Related Issue

Fixes #288

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Other (security config, docs update, etc)

Checklist before merging

• Test, docs, adr added or updated as needed
• Contributor Guide Steps(https://github.com/defenseunicorns/uds-template-capability/blob/main/CONTRIBUTING.md#submitting-a-pull-request) followed

[Racer159]

Post changes with retain slashes set to true:

Pre changes (and without retain slashes):

(Decided to leave path normalization on except for decoding slashes since it shouldn't really hurt anything - I don't know of any apps that expect double slashes or other weird slash configs)

[jeff-mccoy]

Holding this one hostage until we discuss further, I really don't think we should do this and would rather remove the Istio Path Normalization than add all this complexity.

[Racer159]

Holding this one hostage until we discuss further, I really don't think we should do this and would rather remove the Istio Path Normalization than add all this complexity.

Yep got no problem with that, was fun learning more about Istio anyway 😅

[bburky]

@jeff-mccoy

Holding this one hostage until we discuss further, I really don't think we should do this and would rather remove the Istio Path Normalization than add all this complexity.

Ok.

We'll likely be unable to use path-based AuthorizationPolices with any confidence across all of UDS without careful review of each app individually. I would have liked to have had the ability to use AuthorizationPolices to apply CVE mitigations on UDS apps, see #288 (comment) for more context. In theory we can still do this, but we'll have to review each app's URL decoding implementation before doing so.

For Keycloak specifically, MERGE_SLASHES seems to be sufficient. I did some light manual testing, and //admin is still blocked (redirected) with MERGE_SLASHES, /%2fadmin is now a keycloak error (good, not allowed through). A cursory review of the source code (in vertx via quarkus via keycloak), suggests only alpha, didgit, hyphen, period, underscore and tilde characters are URL decoded:
https://github.com/eclipse-vertx/vert.x/blob/5832acf2fb22ed0301c396d4c3a7c316005e2939/src/main/java/io/vertx/core/http/impl/HttpUtils.java#L317-L329

At least MERGE_SLASHES level of normalization is required if we use path-based AuthorizationPolicies on Keycloak, because Keycloak merges // into / (example: //admin is a valid URL). This is because Keycloak implements this non-standard (but common, as they note) normalization:
https://github.com/eclipse-vertx/vert.x/blob/5832acf2fb22ed0301c396d4c3a7c316005e2939/src/main/java/io/vertx/core/http/impl/HttpUtils.java#L390-L393

[mjnagel]

LGTM! Thanks for the fix here!

Dismissing this as the target change pivoted from the original envoyfilter approach.