Correctly url-decode the path segment in the http_server.

pkg/http_server/lib/src/virtual_directory.dart

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 part of http_server;
 
 /**
  * A [VirtualDirectory] can serve files and directory-listing from a root path,
  * to [HttpRequest]s.
  *
@@ skipping 47 matching lines @@
    */
   void setErrorPageHandler(void callback(HttpRequest request));
 }
 
 class _VirtualDirectory implements VirtualDirectory {
   final String root;
 
   bool allowDirectoryListing = false;
   bool followLinks = true;
 
+  final RegExp _invalidPathRegExp = new RegExp("[\\\/\x00]");
+
   Function _errorCallback;
   Function _dirCallback;
 
   _VirtualDirectory(this.root);
 
   void serve(Stream<HttpRequest> requests) {
     requests.listen(serveRequest);
   }
 
   void serveRequest(HttpRequest request) {
-    var path = new Path(request.uri.path).canonicalize();
-
-    if (!path.isAbsolute) {
-      return _serveErrorPage(HttpStatus.NOT_FOUND, request);
-    }
-
-    _locateResource(new Path('.'), path.segments())
+    _locateResource(new Path('.'), request.uri.pathSegments.iterator..moveNext())
         .then((entity) {
           if (entity == null) {
             _serveErrorPage(HttpStatus.NOT_FOUND, request);
             return;
           }
           if (entity is File) {
             _serveFile(entity, request);
           } else if (entity is Directory) {
             _serveDirectory(entity, request);
           } else {
             _serveErrorPage(HttpStatus.NOT_FOUND, request);
           }
         });
   }
 
   void setDirectoryHandler(void callback(Directory dir, HttpRequest request)) {
     _dirCallback = callback;
   }
 
   void setErrorPageHandler(void callback(HttpRequest request)) {
     _errorCallback = callback;
   }
 
   Future<FileSystemEntity> _locateResource(Path path,
-                                           Iterable<String> segments) {
+                                           Iterator<String> segments) {
+    path = path.canonicalize();
+    if (path.segments().first == "..") return new Future.value(null);
     Path fullPath() => new Path(root).join(path);
     return FileSystemEntity.type(fullPath().toNativePath(), followLinks: false)
         .then((type) {
           switch (type) {
             case FileSystemEntityType.FILE:
-              if (segments.isEmpty) return new File.fromPath(fullPath());
+              if (segments.current == null) {
+                return new File.fromPath(fullPath());
+              }
               break;
 
             case FileSystemEntityType.DIRECTORY:
-              if (segments.isEmpty) {
+              if (segments.current == null) {
                 if (allowDirectoryListing) {
                   return new Directory.fromPath(fullPath());
                 }
               } else {
-                return _locateResource(path.append(segments.first),
-                                       segments.skip(1));
+                if (_invalidPathRegExp.hasMatch(segments.current)) break;
+                return _locateResource(path.append(segments.current),
+                                       segments..moveNext());
               }
               break;
 
             case FileSystemEntityType.LINK:
               if (followLinks) {
                 return new Link.fromPath(fullPath()).target()
                     .then((target) {
                       var targetPath = new Path(target).canonicalize();
                       if (targetPath.isAbsolute) return null;
-                      targetPath =
-                          path.directoryPath.join(targetPath).canonicalize();
-                      if (targetPath.segments().isEmpty ||
-                          targetPath.segments().first == '..') return null;
-                      if (segments.isEmpty) {
-                        return _locateResource(targetPath, []);
-                      }
-                      return _locateResource(targetPath.append(segments.first),
-                                             segments.skip(1));
+                      targetPath = path.directoryPath.join(targetPath);
+                      return _locateResource(targetPath, segments);
                     });
               }
               break;
           }
           // Return `null` on fall-through, to indicate NOT_FOUND.
           return null;
         });
   }
 
   void _serveFile(File file, HttpRequest request) {
@@ skipping 218 matching lines @@
 
   Future close() => new Future.value();
 
   void setMimeType(var bytes) {
     var mimeType = lookupMimeType(path, headerBytes: bytes);
     if (mimeType != null) {
       response.headers.contentType = ContentType.parse(mimeType);
     }
   }
 }