incorrect path escaping

[scf37]

Given route:

get(paths[String]) { p: Seq[String] =>
      Ok(p.toString)
}

GET /../secret prints "List(secret)"
but
GET /%2E%2E/secret prints "List(.., secret)"
and
GET /%2F/etc/passwd prints "List(/, etc, passwd)"

This can be nasty for unsuspecting people serving files from local disk

finch version:0.22.0

[vkostyukov]

Thanks for the ticket, @scf37!

What happens in version 0.25? Also, which output you think it should yield?

[scf37]

0.25 - same behavior.

I believe finch should either sanitize paths properly or do not sanitize them at all.
E.g. /a/../b should produce the same result as /a/%2E%2E/b - either List(b) or List(a, .., b)

Since urlencoded path segments are weird but perfectly RFC-valid, I believe finch should not cut .. segments from the input.