Correctly url-decode the path segment in the http_server.

pkg/http_server/lib/src/virtual_directory.dart

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 part of http_server;
 
 /**
  * A [VirtualDirectory] can serve files and directory-listing from a root path,
  * to [HttpRequest]s.
  *
@@ skipping 57 matching lines @@
   Function _errorCallback;
   Function _dirCallback;
 
   _VirtualDirectory(this.root);
 
   void serve(Stream<HttpRequest> requests) {
     requests.listen(serveRequest);
   }
 
   void serveRequest(HttpRequest request) {
-    var path = new Path(request.uri.path).canonicalize();
-
-    if (!path.isAbsolute) {
-      return _serveErrorPage(HttpStatus.NOT_FOUND, request);
-    }
-
-    _locateResource(new Path('.'), path.segments())
+    _locateResource(new Path('.'), request.uri.pathSegments)
         .then((entity) {
           if (entity == null) {
             _serveErrorPage(HttpStatus.NOT_FOUND, request);
             return;
           }
           if (entity is File) {
             _serveFile(entity, request);
           } else if (entity is Directory) {
             _serveDirectory(entity, request);
           } else {
             _serveErrorPage(HttpStatus.NOT_FOUND, request);
           }
         });
   }
 
   void setDirectoryHandler(void callback(Directory dir, HttpRequest request)) {
     _dirCallback = callback;
   }
 
   void setErrorPageHandler(void callback(HttpRequest request)) {
     _errorCallback = callback;
   }
 
   Future<FileSystemEntity> _locateResource(Path path,
                                            Iterable<String> segments) {
+    path = path.canonicalize();

[Lasse Reichstein Nielsen, 2013/07/02 07:31:14]

So you canonicalize after each segment is added.
Will a path not containing "." or ".." canonicalize to itself?

[Anders Johnsen, 2013/07/02 11:08:07]

Yes, that's the idea.

+    if (path.segments().first == "..") return new Future.value(null);
     Path fullPath() => new Path(root).join(path);
     return FileSystemEntity.type(fullPath().toNativePath(), followLinks: false)
         .then((type) {
           switch (type) {
             case FileSystemEntityType.FILE:
               if (segments.isEmpty) return new File.fromPath(fullPath());
               break;
 
             case FileSystemEntityType.DIRECTORY:
               if (segments.isEmpty) {
                 if (allowDirectoryListing) {
                   return new Directory.fromPath(fullPath());
                 }
               } else {
                 return _locateResource(path.append(segments.first),
                                        segments.skip(1));

[Lasse Reichstein Nielsen, 2013/07/02 07:31:14]

Ick. That's no way to treat an iterable.
Consider doing a new Queue.from(segments) so you have an efficient removeFirst.
Or pass an Iterator intead of an Iterable. 
You are doing layered skips which can end up as (if we don't recognize and
optimizie it) a linear space and quadratic time operation.

[Anders Johnsen, 2013/07/02 11:08:07]

Done.

               }
               break;
 
             case FileSystemEntityType.LINK:
               if (followLinks) {
                 return new Link.fromPath(fullPath()).target()
                     .then((target) {
                       var targetPath = new Path(target).canonicalize();
                       if (targetPath.isAbsolute) return null;
-                      targetPath =
-                          path.directoryPath.join(targetPath).canonicalize();
-                      if (targetPath.segments().isEmpty ||
-                          targetPath.segments().first == '..') return null;
-                      if (segments.isEmpty) {
-                        return _locateResource(targetPath, []);
-                      }
-                      return _locateResource(targetPath.append(segments.first),
-                                             segments.skip(1));
+                      targetPath = path.directoryPath.join(targetPath);
+                      return _locateResource(targetPath, segments);
                     });
               }
               break;
           }
           // Return `null` on fall-through, to indicate NOT_FOUND.
           return null;
         });
   }
 
   void _serveFile(File file, HttpRequest request) {
@@ skipping 218 matching lines @@
 
   Future close() => new Future.value();
 
   void setMimeType(var bytes) {
     var mimeType = lookupMimeType(path, headerBytes: bytes);
     if (mimeType != null) {
       response.headers.contentType = ContentType.parse(mimeType);
     }
   }
 }