[🐛 Bug]: [py] Proxy authentication fails when password contains special characters due to double-encoding

[Kr1SEl]

Description

Description:
When using a proxy server that requires authentication where the password contains special characters (like #), the authentication fails because:

• The password gets URL-encoded when creating the proxy URL string
• The encoded password then gets base64-encoded in headers, causing authentication failure

Expected Behavior:
Proxy authentication should work with passwords containing special characters when properly encoded.

Actual Behavior:
Authentication fails with 407 error when proxy password contains special characters because:

Root Cause:

• In RemoteConnection._separate_http_proxy_auth(), an error will be thrown if special characters (like #) are not URL-encoded, because these characters are used as delimiters during URL parsing. Hence, URL encoding is required for credentials with special characters.
• In RemoteConnection._get_connection_manager(), urllib3.make_headers() base64-encodes the already-encoded password, without decoding it.
• The proxy server receives passw%23rd instead of passw#rd as the base64 Authorisation header.

Suggested Fix:
The password should be URL-unquoted before being passed to make_headers() for base64 encoding. The fix would involve adding urllib.parse.unquote() for the password component in _get_connection_manager().

Reproducible Code

def test_selenium_webdriver():
    hub_url = "http://abc.perfectomobile.com/nexperience/perfectomobile/wd/hub"
    proxy = Proxy(
        {
            "proxyType": ProxyType.MANUAL,
            "httpProxy": "http://user:passw%23rd@proxy.net:8080",  # passwo#rd in URL encoded format
        }
    )
    options = webdriver.ChromeOptions()
    client_config = ClientConfig(hub_url, proxy=proxy)
    connection = RemoteConnection(client_config=client_config)
    driver = webdriver.Remote(connection, options=options)
    assert driver.session_id

[selenium-ci]

@Kr1SEl, thank you for creating this issue. We will troubleshoot it as soon as we can.

Selenium Triage Team: remember to follow the Triage Guide

[cgoldberg]

@Kr1SEl I took a shot at fixing this: #16105

Your reasoning and suggested fix is good, but I am hesitant to merge this without adding unit tests. It didn't break anything when I ran the local tests, but we aren't covering this specific scenario. I looked at remote_connection_tests.py and what we have isn't exactly simple :/

If you could add some tests for this, I can review them. Otherwise, I will have to get back to this when I have some more time.

[AaryanGhawali21]

Analysis of the Bug Report
The core issue is a proxy authentication failure caused by a double-encoding problem with passwords containing special characters like #.

The Problem
A special character in the password (e.g., #) is first URL-encoded to become %23 when the proxy URL is built.

The urllib3.make_headers() function then incorrectly takes this already encoded string (passw%23rd) and base64-encodes it for the Proxy-Authorization header.

This results in the proxy server receiving the wrong password, leading to a 407 Proxy Authentication Required error.

The Root Cause
The urllib3.make_headers() function doesn't know that the password it's receiving has already been URL-encoded. It blindly applies a second layer of encoding (base64) to the already encoded password, which is the incorrect behavior.

Suggested Fix
The solution is to URL-decode the password just before it's passed to the make_headers() function. This ensures that the base64 encoding is applied to the original, correct password, allowing for successful authentication.

[cgoldberg]

@AaryanGhawali21 that just regurgitates the original bug report and applied fix. Please stop filling the issue tracker with AI generated crap.