fix: escape literal percent in error-page local reply body

The extension server injects the branded error page into Envoy's
local_reply_config as a SubstitutionFormatString (TextFormatSource), so
Envoy parses the body as a format template. Any bare '%' in the HTML is
read as the start of a command operator; the embedded default page's CSS
(e.g. "height: 100%") is not escaped, so Envoy rejects the whole listener
("Couldn't find valid command at position 330"). On the failOpen:false
downstream hook that NACKs the xDS update fleet-wide, taking every route
with a TrafficProtectionPolicy in Enforce mode offline.

Escape bare '%' to '%%' at inject time while preserving already-escaped
'%%' and valid '%COMMAND%' operators (such as the intended
%RESPONSE_CODE%). The transform is idempotent and also protects any
mounted override page.

Fixes #243

Key changes:
- add escapeEnvoyFormatLiterals and apply it to the local reply body
- unit tests for the escaper and a regression guard asserting the
  embedded default page is Envoy-safe after escaping

Author: ecv

internal/extensionserver/mutate/localreply.go

@@ -2,6 +2,8 @@ package mutate
 
 import (
 	"fmt"
+	"regexp"
+	"strings"
 
 	accesslogv3 "github.com/envoyproxy/go-control-plane/envoy/config/accesslog/v3"
 	corev3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
@@ -146,10 +148,51 @@ func buildLocalReplyConfig(cfg *LocalReplyConfig) *hcmv3.LocalReplyConfig {
 				ContentType: cfg.ContentType,
 				Format: &corev3.SubstitutionFormatString_TextFormatSource{
 					TextFormatSource: &corev3.DataSource{
-						Specifier: &corev3.DataSource_InlineString{InlineString: cfg.BodyHTML},
+						Specifier: &corev3.DataSource_InlineString{InlineString: escapeEnvoyFormatLiterals(cfg.BodyHTML)},
 					},
 				},
 			},
 		}},
 	}
 }
+
+// envoyCommandToken matches a single well-formed Envoy substitution command
+// operator (e.g. %RESPONSE_CODE%, %REQ(x-header)%, %REQ(x-header):10%) anchored
+// at the start of the input. It is used to distinguish intended command
+// operators from literal percent signs.
+var envoyCommandToken = regexp.MustCompile(`^%[A-Z0-9_]+(\([^)]*\))?(:[0-9]+)?%`)
+
+// escapeEnvoyFormatLiterals makes an arbitrary string safe to embed as the
+// text_format of an Envoy SubstitutionFormatString. Envoy parses that string as
+// a format template, so any bare '%' is read as the start of a command operator
+// and an unrecognized one is rejected — which, on the failOpen:false downstream
+// hook, NACKs the whole listener xDS update fleet-wide (see issue #243: the
+// branded error page's CSS "height: 100%" took the listener down).
+//
+// Bare '%' are escaped to '%%' (Envoy's literal-percent escape) while
+// already-escaped '%%' and valid '%COMMAND%' operators (such as the intended
+// %RESPONSE_CODE%) are preserved unchanged. The transform is idempotent.
+func escapeEnvoyFormatLiterals(s string) string {
+	var b strings.Builder
+	b.Grow(len(s))
+	for i := 0; i < len(s); {
+		if s[i] != '%' {
+			b.WriteByte(s[i])
+			i++
+			continue
+		}
+		if i+1 < len(s) && s[i+1] == '%' {
+			b.WriteString("%%")
+			i += 2
+			continue
+		}
+		if m := envoyCommandToken.FindString(s[i:]); m != "" {
+			b.WriteString(m)
+			i += len(m)
+			continue
+		}
+		b.WriteString("%%")
+		i++
+	}
+	return b.String()
+}

internal/extensionserver/mutate/localreply_test.go

@@ -1,6 +1,8 @@
 package mutate
 
 import (
+	"regexp"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -11,6 +13,8 @@ import (
 	routev3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
 	hcmv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
 	"google.golang.org/protobuf/types/known/anypb"
+
+	"go.datum.net/network-services-operator/internal/extensionserver/assets"
 )
 
 const (
@@ -218,3 +222,54 @@ func TestInjectLocalReplyConfig_NoOp(t *testing.T) {
 		})
 	}
 }
+
+func TestEscapeEnvoyFormatLiterals(t *testing.T) {
+	tests := []struct {
+		name string
+		in   string
+		want string
+	}{
+		{"empty", "", ""},
+		{"no percent", "<html>plain</html>", "<html>plain</html>"},
+		{"bare percent in css", "height: 100%;", "height: 100%%;"},
+		{"multiple bare percents", "120% 50% 0%", "120%% 50%% 0%%"},
+		{"preserve command", "code %RESPONSE_CODE% end", "code %RESPONSE_CODE% end"},
+		{"preserve command with args", "%REQ(x-header)%", "%REQ(x-header)%"},
+		{"preserve command with length", "%REQ(x-header):10%", "%REQ(x-header):10%"},
+		{"already escaped stays escaped", "width: 100%%;", "width: 100%%;"},
+		{"mixed command and literal", "%RESPONSE_CODE% at 100%", "%RESPONSE_CODE% at 100%%"},
+		{"trailing bare percent", "50%", "50%%"},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got := escapeEnvoyFormatLiterals(tc.in)
+			assert.Equal(t, tc.want, got)
+			assert.Equal(t, got, escapeEnvoyFormatLiterals(got), "must be idempotent")
+		})
+	}
+}
+
+// TestEmbeddedDefaultPageIsEnvoySafe is the regression guard for issue #243:
+// the embedded default error page contains literal CSS percent signs
+// (e.g. "height: 100%") that Envoy would misparse as command operators and
+// reject the listener. After escaping, no bare '%' may remain and the intended
+// %RESPONSE_CODE% operator must survive.
+func TestEmbeddedDefaultPageIsEnvoySafe(t *testing.T) {
+	raw := assets.DefaultError5xxHTML
+	require.Contains(t, raw, "height: 100%;", "test premise: raw page has an unescaped percent")
+
+	escaped := escapeEnvoyFormatLiterals(raw)
+
+	assert.Contains(t, escaped, "height: 100%%;", "literal percent must be escaped")
+	assert.Equal(t, 1, strings.Count(escaped, "%RESPONSE_CODE%"), "command operator must be preserved exactly once")
+	assert.Equal(t, escaped, escapeEnvoyFormatLiterals(escaped), "escaping must be idempotent")
+
+	// No bare '%' may remain: every '%' is either part of a '%%' pair or a
+	// valid command token. Strip the escaped pairs first, then the command
+	// tokens (with a non-anchored copy of the operator pattern), and assert
+	// nothing is left.
+	commandToken := regexp.MustCompile(`%[A-Z0-9_]+(\([^)]*\))?(:[0-9]+)?%`)
+	residual := strings.ReplaceAll(escaped, "%%", "")
+	residual = commandToken.ReplaceAllString(residual, "")
+	assert.NotContains(t, residual, "%", "no bare percent may remain after escaping")
+}