Fix XSS issues in http_server's dir-listing and error-page.

pkg/http_server/test/virtual_directory_test.dart

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 import 'dart:async';
 import 'dart:io';
 
 import "package:http_server/http_server.dart";
 import 'package:path/path.dart' as pathos;
 import "package:unittest/unittest.dart";
@@ skipping 81 matching lines @@
   });
 
   group('serve-dir', () {
     group('top-level', () {
       testVirtualDir('simple', (dir) {
         var virDir = new VirtualDirectory(dir.path);
         virDir.allowDirectoryListing = true;
 
         return getAsString(virDir, '/')
           .then((result) {
-            expect(result, contains('Index of /'));
+            expect(result, contains('Index of &#x2F'));
           });
       });
 
       testVirtualDir('files', (dir) {
         var virDir = new VirtualDirectory(dir.path);
         for (int i = 0; i < 10; i++) {
           new File('${dir.path}/$i').createSync();
         }
         virDir.allowDirectoryListing = true;
 
         return getAsString(virDir, '/')
           .then((result) {
-            expect(result, contains('Index of /'));
+            expect(result, contains('Index of &#x2F'));
           });
       });
 
       testVirtualDir('dirs', (dir) {
         var virDir = new VirtualDirectory(dir.path);
         for (int i = 0; i < 10; i++) {
           new Directory('${dir.path}/$i').createSync();
         }
         virDir.allowDirectoryListing = true;
 
         return getAsString(virDir, '/')
           .then((result) {
-            expect(result, contains('Index of /'));
+            expect(result, contains('Index of &#x2F'));
           });
       });
 
+      testVirtualDir('encoded', (dir) {
+        var virDir = new VirtualDirectory(dir.path);
+        new Directory('${dir.path}/alert(\'hacked!\');').createSync();

[nweiz, 2014/04/04 18:06:37]

"/" isn't a great test case for HTML-escaping because it's not an HTML-active
character. Make sure you test "<", ">", and "&".

[Anders Johnsen, 2014/04/07 07:03:08]

Done.

+        virDir.allowDirectoryListing = true;
+
+        return getAsString(virDir, '/alert(\'hacked!\');')
+          .then((result) {
+            expect(result, contains('/alert('hacked!');/'));
+          });
+      });
+
+      testVirtualDir('encoded', (dir) {
+        var virDir = new VirtualDirectory(dir.path);
+        new Directory('${dir.path}/javascript:alert(document);"').createSync();
+        virDir.allowDirectoryListing = true;
+
+        return getAsString(virDir, '/')
+          .then((result) {
+            expect(result, contains('%2Fjavascript%3Aalert(document)%3B%22'));
+          });
+      });
+
       if (!Platform.isWindows) {
         testVirtualDir('recursive-link', (dir) {
           var link = new Link('${dir.path}/recursive')..createSync('.');
           var virDir = new VirtualDirectory(dir.path);
           virDir.allowDirectoryListing = true;
 
           return Future.wait([
               getAsString(virDir, '/').then(
-                  (s) => s.contains('recursive/')),
+                  (s) => s.contains('recursive/')),
               getAsString(virDir, '/').then(
                   (s) => !s.contains('../')),
               getAsString(virDir, '/').then(
-                  (s) => s.contains('Index of /')),
+                  (s) => s.contains('Index of /')),
               getAsString(virDir, '/recursive').then(
-                  (s) => s.contains('recursive/')),
+                  (s) => s.contains('recursive/')),
               getAsString(virDir, '/recursive').then(
-                  (s) => s.contains('../')),
+                  (s) => s.contains('../')),
               getAsString(virDir, '/recursive').then(
-                  (s) => s.contains('Index of /recursive'))])
+                  (s) => s.contains('Index of /recursive'))])
             .then((result) {
               expect(result, equals([true, true, true, true, true, true]));
             });
         });
       }
     });
 
     group('custom', () {
       testVirtualDir('simple', (dir) {
         var virDir = new VirtualDirectory(dir.path);
@@ skipping 369 matching lines @@
           return virDir.serveFile(new File('${d.path}/file'), request);
         };
 
         return getAsString(virDir, '/')
           .then((result) {
             expect(result, 'file contents');
           });
     });
   });
 }