Correctly url-decode the path segment in the http_server.

pkg/http_server/test/virtual_directory_test.dart

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 import 'dart:async';
 import 'dart:io';
 
 import "package:unittest/unittest.dart";
 import "package:http_server/http_server.dart";
 
@@ skipping 458 matching lines @@
         });
         virDir.serve(server);
 
         return getAsString(server.port, '/')
             .whenComplete(() {
               server.close();
             });
       }), completion(equals('my-page 404')));
     });
   });
+
+  group('escape-root', () {
+    test('escape1', () {
+      expect(HttpServer.bind('localhost', 0).then((server) {
+        var dir = new Directory('').createTempSync();
+        var virDir = new VirtualDirectory(dir.path);
+        virDir.allowDirectoryListing = true;
+
+        virDir.serve(server);
+
+        return getStatusCode(server.port, '/../')
+            .whenComplete(() {
+              server.close();
+              dir.deleteSync();
+            });
+      }), completion(equals(HttpStatus.NOT_FOUND)));
+    });
+
+    test('escape2', () {
+      expect(HttpServer.bind('localhost', 0).then((server) {
+        var dir = new Directory('').createTempSync();
+        new Directory('${dir.path}/dir').createSync();
+        var virDir = new VirtualDirectory(dir.path);
+        virDir.allowDirectoryListing = true;
+
+        virDir.serve(server);
+
+        return getStatusCode(server.port, '/dir/../../')
+            .whenComplete(() {
+              server.close();
+              dir.deleteSync(recursive: true);
+            });
+      }), completion(equals(HttpStatus.NOT_FOUND)));
+    });
+  });
+
+  group('url-decode', () {
+    test('with-space', () {
+      expect(HttpServer.bind('localhost', 0).then((server) {
+        var dir = new Directory('').createTempSync();
+        var file = new File('${dir.path}/my file')..createSync();
+        var virDir = new VirtualDirectory(dir.path);
+
+        virDir.serve(server);
+
+        return getStatusCode(server.port, '/my file')
+            .whenComplete(() {
+              server.close();
+              dir.deleteSync(recursive: true);
+            });
+      }), completion(equals(HttpStatus.OK)));
+    });
+
+    test('encoded-space', () {
+      expect(HttpServer.bind('localhost', 0).then((server) {
+        var dir = new Directory('').createTempSync();
+        var file = new File('${dir.path}/my file')..createSync();
+        var virDir = new VirtualDirectory(dir.path);
+
+        virDir.serve(server);
+
+        return getStatusCode(server.port, '/my%20file')
+            .whenComplete(() {
+              server.close();
+              dir.deleteSync(recursive: true);
+            });
+      }), completion(equals(HttpStatus.NOT_FOUND)));
+    });
+
+    testEncoding(name, expected, [bool create = true]) {
+      test('encode-$name', () {
+        expect(HttpServer.bind('localhost', 0).then((server) {
+        var dir = new Directory('').createTempSync();
+          if (create) new File('${dir.path}/$name').createSync();
+          var virDir = new VirtualDirectory(dir.path);
+          virDir.allowDirectoryListing = true;
+
+          virDir.serve(server);
+
+          return getStatusCode(server.port, '/$name')
+              .whenComplete(() {
+                server.close();
+                dir.deleteSync(recursive: true);
+              });
+        }), completion(equals(expected)));
+      });
+    }
+    testEncoding('..', HttpStatus.NOT_FOUND, false);
+    testEncoding('%2e%2e', HttpStatus.OK);
+    testEncoding('%252e%252e', HttpStatus.OK);
+    testEncoding('/', HttpStatus.OK, false);
+    testEncoding('%2f', HttpStatus.NOT_FOUND, false);
+    testEncoding('%2f', HttpStatus.OK, true);

[Lasse Reichstein Nielsen, 2013/07/02 07:31:14]

So you are successfully creating a file called "%2f".

Try to make a tests where you send the *encoded* URI containing "/a%2fb/c",
which should have the path segments (after decoding) "a/b" and "c". That is, a
way to test malicious URIs where the sender controls the entire URI and it's not
necessarily well escaped.

[Anders Johnsen, 2013/07/02 11:08:07]

Done.

+  });
 }