Fix encoded path traversal corruption in sub-router handlers (#2900) (#2903)

See #2898

When a request with encoded dot-segments (e.g. %2e%2e%2f) hit a handler mounted inside a sub-router via a regex or parameterized route, Utils.pathOffset corrupted the route-relative path because dot-segment resolution had already consumed the mount-point prefix.

Fix by running pathOffset on the raw normalizedPath first, then decoding and resolving dot-segments on the result.

Also remove the now redundant decodeURIComponent and removeDotSegments calls from StaticHandlerImpl.handle(), since normalizedPath() already decodes unreserved characters and resolves dot-segments, and file path resolution is now fully handled in getFile().

Some portions of this content were created with the assistance of Claude Code.

Signed-off-by: Thomas Segismont <tsegismont@gmail.com>

Author: tsegismont

vertx-web/src/main/java/io/vertx/ext/web/handler/impl/StaticHandlerImpl.java

@@ -146,16 +146,7 @@ public void handle(RoutingContext context) {
       if (!request.isEnded()) {
         request.pause();
       }
-      // decode URL path
-      String uriDecodedPath = RFC3986.decodeURIComponent(context.normalizedPath(), false);
-      // if the normalized path is null it cannot be resolved
-      if (uriDecodedPath == null) {
-        LOG.warn("Invalid path: " + context.request().path());
-        context.next();
-        return;
-      }
-      // will normalize and handle all paths as UNIX paths
-      String path = RFC3986.removeDotSegments(uriDecodedPath.replace('\\', '/'));
+      String path = context.normalizedPath();
 
       // Access fileSystem once here to be safe
       FileSystem fs = context.vertx().fileSystem();
@@ -178,7 +169,7 @@ private void sendStatic(RoutingContext context, FileSystem fileSystem, String pa
     String file = null;
 
     if (!includeHidden) {
-      file = getFile(path, context);
+      file = getFile(context);
       for (int idx = file.indexOf('/'); idx >= 0; idx = file.indexOf('/', idx + 1)) {
         String name = file.substring(idx + 1);
         if (name.length() > 0 && name.charAt(0) == '.') {
@@ -226,7 +217,7 @@ private void sendStatic(RoutingContext context, FileSystem fileSystem, String pa
     final String localFile;
 
     if (file == null) {
-      String ctxFile = getFile(path, context);
+      String ctxFile = getFile(context);
       if (index) {
         localFile = ctxFile + indexPage;
       } else {
@@ -639,8 +630,10 @@ public StaticHandler setDefaultContentEncoding(String contentEncoding) {
     return this;
   }
 
-  private String getFile(String path, RoutingContext context) {
-    String file = webRoot + Utils.pathOffset(path, context);
+  private String getFile(RoutingContext context) {
+    String offsetPath = Utils.pathOffset(context.normalizedPath(), context);
+    offsetPath = RFC3986.decodeURIComponent(offsetPath, false);
+    String file = webRoot + RFC3986.removeDotSegments(offsetPath.replace('\\', '/'));
     if (LOG.isTraceEnabled()) {
       LOG.trace("File to serve is " + file);
     }

vertx-web/src/main/java/io/vertx/ext/web/handler/impl/TemplateHandlerImpl.java

@@ -45,10 +45,9 @@ public TemplateHandlerImpl(TemplateEngine engine, String templateDirectory, Stri
 
   @Override
   public void handle(RoutingContext context) {
-    String uriDecodedPath = RFC3986.decodeURIComponent(context.normalizedPath(), false);
-    String path = RFC3986.removeDotSegments(uriDecodedPath.replace('\\', '/'));
-
-    String file = Utils.pathOffset(path, context);
+    String file = Utils.pathOffset(context.normalizedPath(), context);
+    file = RFC3986.decodeURIComponent(file, false);
+    file = RFC3986.removeDotSegments(file.replace('\\', '/'));
     if (file.endsWith("/") && null != indexTemplate) {
       file += indexTemplate;
     }

vertx-web/src/test/java/io/vertx/ext/web/tests/SubRouterTest.java

@@ -17,13 +17,19 @@
 package io.vertx.ext.web.tests;
 
 import io.netty.handler.codec.http.HttpResponseStatus;
+import io.vertx.core.Future;
 import io.vertx.core.Handler;
 import io.vertx.core.Vertx;
+import io.vertx.core.buffer.Buffer;
 import io.vertx.core.http.HttpMethod;
 import io.vertx.ext.web.Router;
 import io.vertx.ext.web.RoutingContext;
+import io.vertx.ext.web.common.template.TemplateEngine;
+import io.vertx.ext.web.handler.StaticHandler;
+import io.vertx.ext.web.handler.TemplateHandler;
 import org.junit.Test;
 
+import java.util.Map;
 import java.util.function.Consumer;
 
 import static io.netty.handler.codec.http.HttpResponseStatus.INTERNAL_SERVER_ERROR;
@@ -847,4 +853,73 @@ public void testSubRouterMethodNotAllowed() throws Exception {
       assertTrue(allowHeader.contains("PUT"));
     }, 405, "Method Not Allowed", null);
   }
+
+  @Test
+  public void testStaticHandlerEncodedPathTraversalWithWildcardRoute() throws Exception {
+    Router subRouter = Router.router(vertx);
+    router.route("/sub/*").subRouter(subRouter);
+    subRouter.route("/*").handler(StaticHandler.create());
+    testRequest(HttpMethod.GET, "/sub/%2e%2e%2fotherpage.html", 200, "OK", "<html><body>Other page</body></html>");
+  }
+
+  @Test
+  public void testStaticHandlerEncodedPathTraversalWithRegexRoute() throws Exception {
+    Router subRouter = Router.router(vertx);
+    router.route("/sub/*").subRouter(subRouter);
+    subRouter.getWithRegex(".+\\.html").handler(StaticHandler.create());
+    testRequest(HttpMethod.GET, "/sub/%2e%2e%2fotherpage.html", 200, "OK", "<html><body>Other page</body></html>");
+  }
+
+  @Test
+  public void testStaticHandlerEncodedPathTraversalWithPathParamRoute() throws Exception {
+    Router subRouter = Router.router(vertx);
+    router.route("/sub/*").subRouter(subRouter);
+    subRouter.get("/:file").handler(StaticHandler.create());
+    testRequest(HttpMethod.GET, "/sub/%2e%2e%2fotherpage.html", 200, "OK", "<html><body>Other page</body></html>");
+  }
+
+  @Test
+  public void testTemplateHandlerEncodedPathTraversalWithWildcardRoute() throws Exception {
+    RecordingTemplateFileNameEngine engine = new RecordingTemplateFileNameEngine();
+    Router subRouter = Router.router(vertx);
+    router.route("/sub/*").subRouter(subRouter);
+    subRouter.route("/*").handler(TemplateHandler.create(engine, "templates", "text/html"));
+    testRequest(HttpMethod.GET, "/sub/%2e%2e%2foutside.html", 200, "OK");
+    assertEquals("templates/outside.html", engine.lastTemplateFileName);
+  }
+
+  @Test
+  public void testTemplateHandlerEncodedPathTraversalWithRegexRoute() throws Exception {
+    RecordingTemplateFileNameEngine engine = new RecordingTemplateFileNameEngine();
+    Router subRouter = Router.router(vertx);
+    router.route("/sub/*").subRouter(subRouter);
+    subRouter.getWithRegex(".+\\.html").handler(TemplateHandler.create(engine, "templates", "text/html"));
+    testRequest(HttpMethod.GET, "/sub/%2e%2e%2foutside.html", 200, "OK");
+    assertEquals("templates/outside.html", engine.lastTemplateFileName);
+  }
+
+  @Test
+  public void testTemplateHandlerEncodedPathTraversalWithPathParamRoute() throws Exception {
+    RecordingTemplateFileNameEngine engine = new RecordingTemplateFileNameEngine();
+    Router subRouter = Router.router(vertx);
+    router.route("/sub/*").subRouter(subRouter);
+    subRouter.get("/:page").handler(TemplateHandler.create(engine, "templates", "text/html"));
+    testRequest(HttpMethod.GET, "/sub/%2e%2e%2foutside.html", 200, "OK");
+    assertEquals("templates/outside.html", engine.lastTemplateFileName);
+  }
+
+  private static class RecordingTemplateFileNameEngine implements TemplateEngine {
+
+    String lastTemplateFileName;
+
+    @Override
+    public Future<Buffer> render(Map<String, Object> context, String templateFileName) {
+      this.lastTemplateFileName = templateFileName;
+      return Future.succeededFuture(Buffer.buffer());
+    }
+
+    @Override
+    public void clearCache() {
+    }
+  }
 }