fix(raw): reject dot-dot segments revealed by decoding encoded separators

rejectPathTraversal split components on literal "/" before checking
each segment, so a segment containing an encoded separator (e.g.
"%2e%2e%2fsecret.txt") decoded to "../secret.txt" instead of "..", and
the check never caught it. Percent-decoding a segment can therefore
introduce new "/"-separated subsegments that were invisible to the
original literal split.

Recursively re-split and re-check the decoded form whenever decoding
changes a segment, so a ".." revealed by one or more layers of
percent-decoding (including through an encoded separator, or
double-encoding) is rejected regardless of where it appears.

Add regression tests for encoded-separator traversal, encoded
separators in other components, and double percent-encoded dot-dot
segments, plus a benign percent-encoded filename case to confirm
non-traversal decodes still pass through.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: SamMorrowDrums

pkg/raw/raw.go

@@ -25,23 +25,41 @@ var errPathTraversal = errors.New(`raw: path segment ".." is not allowed`)
 func rejectPathTraversal(components ...string) error {
 	for _, component := range components {
 		for segment := range strings.SplitSeq(component, "/") {
-			if segment == "" {
-				continue
-			}
-			if segment == ".." {
-				return errPathTraversal
-			}
-			// Guard against percent-encoded traversal (e.g. "%2e%2e") in case
-			// the segment is later decoded before being treated as a path
-			// component.
-			if decoded, err := url.PathUnescape(segment); err == nil && decoded == ".." {
-				return errPathTraversal
+			if err := rejectSegment(segment); err != nil {
+				return err
 			}
 		}
 	}
 	return nil
 }
 
+// rejectSegment reports an error if segment is, or decodes to, "..". A
+// percent-encoded separator (e.g. "%2f") can appear inside a single
+// "/"-separated segment and only becomes a "/" once decoded, revealing new
+// subsegments (e.g. "%2e%2e%2fsecret.txt" decodes to "../secret.txt"). To
+// catch that, whenever decoding changes the segment, the decoded form is
+// split on "/" again and each subsegment is checked recursively, so
+// traversal segments introduced by one or more layers of percent-decoding
+// are rejected regardless of where the encoded separator falls.
+func rejectSegment(segment string) error {
+	if segment == "" {
+		return nil
+	}
+	if segment == ".." {
+		return errPathTraversal
+	}
+	decoded, err := url.PathUnescape(segment)
+	if err != nil || decoded == segment {
+		return nil
+	}
+	for subsegment := range strings.SplitSeq(decoded, "/") {
+		if err := rejectSegment(subsegment); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
 // GetRawClientFn is a function type that returns a RawClient instance.
 type GetRawClientFn func(context.Context) (*Client, error)
 

pkg/raw/raw_test.go

@@ -254,6 +254,42 @@ func TestUrlFromOpts(t *testing.T) {
 			owner: "octocat", repo: "hello", path: "README.md",
 			wantErr: true,
 		},
+		{
+			name:  "encoded separator revealing dot-dot rejected",
+			opts:  nil,
+			owner: "octocat", repo: "hello", path: "%2e%2e%2fsecret.txt",
+			wantErr: true,
+		},
+		{
+			name:  "encoded separator revealing dot-dot mid-path rejected",
+			opts:  nil,
+			owner: "octocat", repo: "hello", path: "docs%2f..%2f..%2fsecret.txt",
+			wantErr: true,
+		},
+		{
+			name:  "encoded separator in owner rejected",
+			opts:  nil,
+			owner: "octocat%2f..", repo: "hello", path: "README.md",
+			wantErr: true,
+		},
+		{
+			name:  "double percent-encoded dot-dot rejected",
+			opts:  nil,
+			owner: "octocat", repo: "hello", path: "%252e%252e/secret.txt",
+			wantErr: true,
+		},
+		{
+			name:  "double percent-encoded separator revealing dot-dot rejected",
+			opts:  nil,
+			owner: "octocat", repo: "hello", path: "%252e%252e%252fsecret.txt",
+			wantErr: true,
+		},
+		{
+			name:  "benign percent-encoded filename allowed",
+			opts:  nil,
+			owner: "octocat", repo: "hello", path: "%2ehidden",
+			want: "https://raw.example.com/octocat/hello/HEAD/%2ehidden",
+		},
 	}
 
 	for _, tt := range tests {