Correctly url-decode the path segment in the http_server.

pkg/http_server/test/virtual_directory_test.dart

Index: pkg/http_server/test/virtual_directory_test.dart
diff --git a/pkg/http_server/test/virtual_directory_test.dart b/pkg/http_server/test/virtual_directory_test.dart
index ca7094883dc8ac1975a6414cc4030a6d1bf1fa53..dbe73562b5c986b7ae9639860f019d15f5d880d2 100644
--- a/pkg/http_server/test/virtual_directory_test.dart
+++ b/pkg/http_server/test/virtual_directory_test.dart
@@ -476,5 +476,72 @@ void main() {
       }), completion(equals('my-page 404')));
     });
   });
+
+  group('escape-root', () {
+    test('escape1', () {
+      expect(HttpServer.bind('localhost', 0).then((server) {
+        var dir = new Directory('').createTempSync();
+        var virDir = new VirtualDirectory(dir.path);
+
+        virDir.serve(server);
+
+        return getStatusCode(server.port, '/../')
+            .whenComplete(() {
+              server.close();
+              dir.deleteSync();
+            });
+      }), completion(equals(HttpStatus.NOT_FOUND)));
+    });
+
+    test('escape1', () {
+      expect(HttpServer.bind('localhost', 0).then((server) {
+        var dir = new Directory('').createTempSync();
+        new Directory('${dir.path}/dir').createSync();
+        var virDir = new VirtualDirectory(dir.path);
+
+        virDir.serve(server);
+
+        return getStatusCode(server.port, '/dir/../../')
+            .whenComplete(() {
+              server.close();
+              dir.deleteSync(recursive: true);
+            });
+      }), completion(equals(HttpStatus.NOT_FOUND)));
+    });
+  });
+
+  group('url-decode', () {
+    test('with-space', () {
+      expect(HttpServer.bind('localhost', 0).then((server) {
+        var dir = new Directory('').createTempSync();
+        var file = new File('${dir.path}/my file')..createSync();
+        var virDir = new VirtualDirectory(dir.path);
+
+        virDir.serve(server);
+
+        return getStatusCode(server.port, '/my file')
+            .whenComplete(() {
+              server.close();
+              dir.deleteSync(recursive: true);
+            });
+      }), completion(equals(HttpStatus.OK)));
+    });
+
+    test('encoded-space', () {
+      expect(HttpServer.bind('localhost', 0).then((server) {
+        var dir = new Directory('').createTempSync();
+        var file = new File('${dir.path}/my file')..createSync();
+        var virDir = new VirtualDirectory(dir.path);
+
+        virDir.serve(server);
+
+        return getStatusCode(server.port, '/my%20file')

[Lasse Reichstein Nielsen, 2013/07/01 11:51:51]

Test with strings containing:
 %2e%2e ("..")
 %2f  ("/", probably won't work, since the underlying file system cannot ignore
slashes - can your VirtualDirectory handle file names with slashes?)
 %252e%252e  (double encoded "..")

You may want to consider having a helper function for these tests instead of
duplicating code. Too much boilerplate discourages making many tests, and we
want many tests!

[Anders Johnsen, 2013/07/01 14:14:12]

Done.

+            .whenComplete(() {
+              server.close();
+              dir.deleteSync(recursive: true);
+            });
+      }), completion(equals(HttpStatus.NOT_FOUND)));
+    });
+  });
 }