Reject ambiguous encoded forward paths

Author: eldryoth

crates/fluxheim-common/src/path_safety.rs

@@ -32,13 +32,17 @@ fn safe_forward_path_segment(segment: &str) -> bool {
         if unsafe_decoded_forward_path_segment(&decoded) {
             return false;
         }
-        match std::str::from_utf8(&decoded) {
-            Ok(decoded_text) if decoded_text.contains('%') => {
-                current.clear();
-                current.push_str(decoded_text);
-            }
-            _ => return true,
+        let Ok(decoded_text) = std::str::from_utf8(&decoded) else {
+            return false;
+        };
+        if decoded_text.chars().any(char::is_control) {
+            return false;
+        }
+        if !decoded_text.contains('%') {
+            return true;
         }
+        current.clear();
+        current.push_str(decoded_text);
     }
 
     if current.contains('%') {
@@ -115,5 +119,14 @@ mod tests {
     #[test]
     fn accepts_safe_percent_encoded_path_and_query() {
         assert!(safe_forward_path_and_query("/assets/%66ile.css?v=%252e"));
+        assert!(safe_forward_path("/caf%C3%A9/menu"));
+    }
+
+    #[test]
+    fn rejects_invalid_utf8_and_encoded_unicode_controls() {
+        assert!(!safe_forward_path("/%c0%afadmin"));
+        assert!(!safe_forward_path("/%ff"));
+        assert!(!safe_forward_path("/%c2%85admin"));
+        assert!(!safe_forward_path("/%25c2%2585admin"));
     }
 }

crates/fluxheim-server/src/native_http1_route_redirect_tests.rs

@@ -39,6 +39,26 @@ async fn native_route_proxy_redirect_rejects_unsafe_uri_expansion() {
     assert!(response.ends_with("invalid redirect target\n"));
 }
 
+#[tokio::test]
+async fn native_route_proxy_redirect_rejects_ambiguous_encoded_path() {
+    let route = NativeHttp1RouteProxyRoute::prefix_redirect(
+        "/old",
+        Vec::new(),
+        "https://new.example{uri}",
+        308,
+    );
+    let proxy = route_proxy_listener(NativeHttp1RouteProxy::new(vec![route], None)).await;
+
+    for target in ["/old/%c0%afadmin", "/old/%ff", "/old/%c2%85admin"] {
+        let response = downstream_get(proxy, target).await;
+        assert!(
+            response.starts_with("HTTP/1.1 400 Bad Request\r\n"),
+            "target: {target}"
+        );
+        assert!(response.ends_with("invalid redirect target\n"));
+    }
+}
+
 #[tokio::test]
 async fn native_route_proxy_redirect_rejects_query_path_traversal_expansion() {
     let route = NativeHttp1RouteProxyRoute::exact_redirect(

release-notes/RELEASE_NOTES_1.7.12.md

@@ -81,6 +81,9 @@ trailers are not part of this release.
   range admission, reject impossible totals and duplicate metadata, and make
   zero-sized public slice planning return no slices instead of dividing by
   zero.
+- Reject percent-decoded forward-path segments that are not canonical UTF-8 or
+  contain encoded Unicode control characters, preventing disagreement with
+  permissive upstream decoders.
 - Bound storage-bin manifests to 4 KiB and use no-follow, nonblocking regular
   file reads so oversized or special persistent files fail closed at startup.
 
@@ -120,3 +123,5 @@ platform, configuration, key handling, and required compliance evidence.
   oversized/FIFO storage-bin manifests.
 - Cache-header tests cover cumulative byte/directive ceilings and quoted-comma
   parsing.
+- Shared path-safety and live redirect tests cover invalid UTF-8, overlong
+  slash encodings, encoded Unicode controls, and valid encoded Unicode.