http headers vs unescape_uri bug

I am not sure if this is resty bug or nginx bug, but here's how to reproduce it:

1. Set up nginx as pop3 proxy:

mail {
    auth_http 127.0.0.1:8080/auth;
    pop3_auth         plain;
    ....

2. Set up 127.0.0.1:8080/auth as a lua generated content:

server {
    listen 127.0.0.1:8080;
    location /auth {
        content_by_lua_block {
            local pass = ngx.unescape_uri(ngx.var.http_auth_pass)
            ngx.log(ngx.ALERT, "Before: ", ngx.var.http_auth_pass, ", after: ", pass)
        }
    }
}

3. Telnet to your nginx pop3 port and try to provide password like "ca ffe+19" (with space and plus characters)

Here's what you get in error.log:

Before: ca%20ffe+19, after: ca ffe 19

So instead of "ca ffe+19" one would get back "ca ffe 19" where plus char is replaced with space.

Start with the nginx POP3 proxy reproduction and the content_by_lua_block calling ngx.unescape_uri on ngx.var.http_auth_pass. Compare the logged Before/after values for a password containing a space and plus sign to determine whether the behavior belongs to nginx or lua-nginx-module. Done means the source plus remains a plus after unescaping, or the responsible component is clearly identified.