Fix XSS issues in http_server's dir-listing and error-page.

pkg/http_server/test/virtual_directory_test.dart

Index: pkg/http_server/test/virtual_directory_test.dart
diff --git a/pkg/http_server/test/virtual_directory_test.dart b/pkg/http_server/test/virtual_directory_test.dart
index c04ec3414522e10bbc534d865dc28ea4015a3124..b58ee31c0a24acb5a3f7ce75fcf1d72cff09d1ff 100644
--- a/pkg/http_server/test/virtual_directory_test.dart
+++ b/pkg/http_server/test/virtual_directory_test.dart
@@ -99,7 +99,7 @@ void main() {
 
         return getAsString(virDir, '/')
           .then((result) {
-            expect(result, contains('Index of /'));
+            expect(result, contains('Index of &#x2F'));
           });
       });
 
@@ -112,7 +112,7 @@ void main() {
 
         return getAsString(virDir, '/')
           .then((result) {
-            expect(result, contains('Index of /'));
+            expect(result, contains('Index of &#x2F'));
           });
       });
 
@@ -125,7 +125,41 @@ void main() {
 
         return getAsString(virDir, '/')
           .then((result) {
-            expect(result, contains('Index of /'));
+            expect(result, contains('Index of &#x2F'));
+          });
+      });
+
+      testVirtualDir('encoded-dir', (dir) {
+        var virDir = new VirtualDirectory(dir.path);
+        new Directory('${dir.path}/alert(\'hacked!\');').createSync();
+        virDir.allowDirectoryListing = true;
+
+        return getAsString(virDir, '/alert(\'hacked!\');')
+          .then((result) {
+            expect(result, contains('/alert('hacked!');/'));
+          });
+      });
+
+      testVirtualDir('encoded-path', (dir) {
+        var virDir = new VirtualDirectory(dir.path);
+        new Directory('${dir.path}/javascript:alert(document);"').createSync();
+        virDir.allowDirectoryListing = true;
+
+        return getAsString(virDir, '/')
+          .then((result) {
+            expect(result, contains('%2Fjavascript%3Aalert(document)%3B%22'));
+          });
+      });
+
+      testVirtualDir('encoded-special', (dir) {
+        var virDir = new VirtualDirectory(dir.path);
+        new Directory('${dir.path}/<>&"').createSync();
+        virDir.allowDirectoryListing = true;
+
+        return getAsString(virDir, '/')
+          .then((result) {
+            expect(result, contains('&lt;&gt;&amp;&quot;&#x2F;'));
+            expect(result, contains('href="%2F%3C%3E%26%22"'));
           });
       });
 
@@ -137,17 +171,17 @@ void main() {
 
           return Future.wait([
               getAsString(virDir, '/').then(
-                  (s) => s.contains('recursive/')),
+                  (s) => s.contains('recursive&#x2F;')),
               getAsString(virDir, '/').then(
                   (s) => !s.contains('../')),
               getAsString(virDir, '/').then(
-                  (s) => s.contains('Index of /')),
+                  (s) => s.contains('Index of &#x2F;')),
               getAsString(virDir, '/recursive').then(
-                  (s) => s.contains('recursive/')),
+                  (s) => s.contains('recursive&#x2F;')),
               getAsString(virDir, '/recursive').then(
-                  (s) => s.contains('../')),
+                  (s) => s.contains('..&#x2F;')),
               getAsString(virDir, '/recursive').then(
-                  (s) => s.contains('Index of /recursive'))])
+                  (s) => s.contains('Index of &#x2F;recursive'))])
             .then((result) {
               expect(result, equals([true, true, true, true, true, true]));
             });