Correctly url-decode the path segment in the http_server.

pkg/http_server/test/virtual_directory_test.dart

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 import 'dart:async';
 import 'dart:io';
 
 import "package:unittest/unittest.dart";
 import "package:http_server/http_server.dart";
 
@@ skipping 458 matching lines @@
         });
         virDir.serve(server);
 
         return getAsString(server.port, '/')
             .whenComplete(() {
               server.close();
             });
       }), completion(equals('my-page 404')));
     });
   });
+
+  group('escape-root', () {
+    test('escape1', () {
+      expect(HttpServer.bind('localhost', 0).then((server) {
+        var dir = new Directory('').createTempSync();
+        var virDir = new VirtualDirectory(dir.path);
+
+        virDir.serve(server);
+
+        return getStatusCode(server.port, '/../')
+            .whenComplete(() {
+              server.close();
+              dir.deleteSync();
+            });
+      }), completion(equals(HttpStatus.NOT_FOUND)));
+    });
+
+    test('escape1', () {
+      expect(HttpServer.bind('localhost', 0).then((server) {
+        var dir = new Directory('').createTempSync();
+        new Directory('${dir.path}/dir').createSync();
+        var virDir = new VirtualDirectory(dir.path);
+
+        virDir.serve(server);
+
+        return getStatusCode(server.port, '/dir/../../')
+            .whenComplete(() {
+              server.close();
+              dir.deleteSync(recursive: true);
+            });
+      }), completion(equals(HttpStatus.NOT_FOUND)));
+    });
+  });
+
+  group('url-decode', () {
+    test('with-space', () {
+      expect(HttpServer.bind('localhost', 0).then((server) {
+        var dir = new Directory('').createTempSync();
+        var file = new File('${dir.path}/my file')..createSync();
+        var virDir = new VirtualDirectory(dir.path);
+
+        virDir.serve(server);
+
+        return getStatusCode(server.port, '/my file')
+            .whenComplete(() {
+              server.close();
+              dir.deleteSync(recursive: true);
+            });
+      }), completion(equals(HttpStatus.OK)));
+    });
+
+    test('encoded-space', () {
+      expect(HttpServer.bind('localhost', 0).then((server) {
+        var dir = new Directory('').createTempSync();
+        var file = new File('${dir.path}/my file')..createSync();
+        var virDir = new VirtualDirectory(dir.path);
+
+        virDir.serve(server);
+
+        return getStatusCode(server.port, '/my%20file')

[Lasse Reichstein Nielsen, 2013/07/01 11:51:51]

Test with strings containing:
 %2e%2e ("..")
 %2f  ("/", probably won't work, since the underlying file system cannot ignore
slashes - can your VirtualDirectory handle file names with slashes?)
 %252e%252e  (double encoded "..")

You may want to consider having a helper function for these tests instead of
duplicating code. Too much boilerplate discourages making many tests, and we
want many tests!

[Anders Johnsen, 2013/07/01 14:14:12]

Done.

+            .whenComplete(() {
+              server.close();
+              dir.deleteSync(recursive: true);
+            });
+      }), completion(equals(HttpStatus.NOT_FOUND)));
+    });
+  });
 }