From 0f6af4edf0d4d32721a0f97e163cc694bf14eeb8 Mon Sep 17 00:00:00 2001
From: Chetan Padia <chetbox@users.noreply.github.com>
Date: Tue, 7 May 2024 11:15:51 +0100
Subject: [PATCH] Fix for files with `%` in filename (#452)

* Add a test file with a percent in the filename

* Fix `href` encoding in directory listing

* Fix for filename with `%` in their filename

* Reinstate `path.join` workaround for Windows
---
 index.js              |  3 ++-
 lib/dirList.js        |  2 +-
 test/dir-list.test.js | 14 ++++++++------
 test/static.test.js   | 27 +++++++++++++++++++++++++++
 test/static/100%.txt  |  1 +
 5 files changed, 39 insertions(+), 8 deletions(-)
 create mode 100644 test/static/100%.txt

diff --git a/index.js b/index.js
index cfa6cb13..f2251fc7 100644
--- a/index.js
+++ b/index.js
@@ -221,7 +221,8 @@ async function fastifyStatic (fastify, opts) {
       }
     }
 
-    const stream = send(request.raw, pathnameForSend, options)
+    // `send(..., path, ...)` will URI-decode path so we pass an encoded path here
+    const stream = send(request.raw, encodeURI(pathnameForSend), options)
     let resolvedFilename
     stream.on('file', function (file) {
       resolvedFilename = file
diff --git a/lib/dirList.js b/lib/dirList.js
index 09c2fdfe..7a9cd3f6 100644
--- a/lib/dirList.js
+++ b/lib/dirList.js
@@ -149,7 +149,7 @@ const dirList = {
       route = path.normalize(path.join(route, '..'))
     }
     return {
-      href: path.join(prefix, route, entry.name).replace(/\\/gu, '/'),
+      href: encodeURI(path.join(prefix, route, entry.name).replace(/\\/gu, '/')),
       name: entry.name,
       stats: entry.stats,
       extendedInfo: entry.extendedInfo
diff --git a/test/dir-list.test.js b/test/dir-list.test.js
index b6e7b56e..7d42202b 100644
--- a/test/dir-list.test.js
+++ b/test/dir-list.test.js
@@ -154,7 +154,7 @@ t.test('dir list, custom options', t => {
   }
 
   const route = '/public/'
-  const content = { dirs: ['deep', 'shallow'], files: ['.example', 'a .md', 'foo.html', 'foobar.html', 'index.css', 'index.html'] }
+  const content = { dirs: ['deep', 'shallow'], files: ['.example', '100%.txt', 'a .md', 'foo.html', 'foobar.html', 'index.css', 'index.html'] }
 
   helper.arrange(t, options, (url) => {
     t.test(route, t => {
@@ -205,7 +205,8 @@ t.test('dir list html format', t => {
 </ul>
 <ul>
   <li><a href="/public/.example" target="_blank">.example</a></li>
-  <li><a href="/public/a .md" target="_blank">a .md</a></li>
+  <li><a href="/public/100%25.txt" target="_blank">100%.txt</a></li>
+  <li><a href="/public/a%20.md" target="_blank">a .md</a></li>
   <li><a href="/public/foo.html" target="_blank">foo.html</a></li>
   <li><a href="/public/foobar.html" target="_blank">foobar.html</a></li>
   <li><a href="/public/index.css" target="_blank">index.css</a></li>
@@ -236,7 +237,8 @@ t.test('dir list html format', t => {
 </ul>
 <ul>
   <li><a href="/public/.example" target="_blank">.example</a></li>
-  <li><a href="/public/a .md" target="_blank">a .md</a></li>
+  <li><a href="/public/100%25.txt" target="_blank">100%.txt</a></li>
+  <li><a href="/public/a%20.md" target="_blank">a .md</a></li>
   <li><a href="/public/foo.html" target="_blank">foo.html</a></li>
   <li><a href="/public/foobar.html" target="_blank">foobar.html</a></li>
   <li><a href="/public/index.css" target="_blank">index.css</a></li>
@@ -492,7 +494,7 @@ t.test('json format with url parameter format', t => {
     }
   }
   const route = '/public/'
-  const jsonContent = { dirs: ['deep', 'shallow'], files: ['.example', 'a .md', 'foo.html', 'foobar.html', 'index.css', 'index.html'] }
+  const jsonContent = { dirs: ['deep', 'shallow'], files: ['.example', '100%.txt', 'a .md', 'foo.html', 'foobar.html', 'index.css', 'index.html'] }
 
   helper.arrange(t, options, (url) => {
     simple.concat({
@@ -539,7 +541,7 @@ t.test('json format with url parameter format and without render option', t => {
     }
   }
   const route = '/public/'
-  const jsonContent = { dirs: ['deep', 'shallow'], files: ['.example', 'a .md', 'foo.html', 'foobar.html', 'index.css', 'index.html'] }
+  const jsonContent = { dirs: ['deep', 'shallow'], files: ['.example', '100%.txt', 'a .md', 'foo.html', 'foobar.html', 'index.css', 'index.html'] }
 
   helper.arrange(t, options, (url) => {
     simple.concat({
@@ -588,7 +590,7 @@ t.test('html format with url parameter format', t => {
     }
   }
   const route = '/public/'
-  const jsonContent = { dirs: ['deep', 'shallow'], files: ['.example', 'a .md', 'foo.html', 'foobar.html', 'index.css', 'index.html'] }
+  const jsonContent = { dirs: ['deep', 'shallow'], files: ['.example', '100%.txt', 'a .md', 'foo.html', 'foobar.html', 'index.css', 'index.html'] }
 
   helper.arrange(t, options, (url) => {
     simple.concat({
diff --git a/test/static.test.js b/test/static.test.js
index 0bbe485a..3a3bb760 100644
--- a/test/static.test.js
+++ b/test/static.test.js
@@ -3963,6 +3963,33 @@ t.test(
   }
 )
 
+t.test(
+  'serves files with % in the filename',
+  async (t) => {
+    t.plan(2)
+
+    const txtContent = fs.readFileSync(path.join(__dirname, 'static', '100%.txt'), 'utf-8')
+
+    const pluginOptions = {
+      root: url.pathToFileURL(path.join(__dirname, '/static')),
+      wildcard: false
+    }
+
+    const fastify = Fastify()
+
+    fastify.register(fastifyStatic, pluginOptions)
+    const response = await fastify.inject({
+      method: 'GET',
+      url: '100%25.txt',
+      headers: {
+        'accept-encoding': '*, *'
+      }
+    })
+    t.equal(response.statusCode, 200)
+    t.same(response.body, txtContent)
+  }
+)
+
 t.test('content-length in head route should not return zero when using wildcard', t => {
   t.plan(6)
 
diff --git a/test/static/100%.txt b/test/static/100%.txt
new file mode 100644
index 00000000..4dd6a5cb
--- /dev/null
+++ b/test/static/100%.txt
@@ -0,0 +1 @@
+100%