GitHub Security Advisory: GHSA-72gr-qfp7-vwhw
Package: h3 (NPM)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: <= 1.15.8
Patched in: 1.15.9

Summary: h3: Double Decoding in `serveStatic` Bypasses `resolveDotSegments` Path Traversal Protection via `%252e%252e`

Details:
## Summary

The `serveStatic` utility in h3 applies a redundant `decodeURI()` call to the request pathname after `H3Event` has already performed percent-decoding with `%25` preservation. This double decoding converts `%252e%252e` into `%2e%2e`, which bypasses `resolveDotSegments()` (since it checks for literal `.` characters, not percent-encoded equivalents). When the resulting asset ID is resolved by URL-based backends (CDN, S3, object storage), `%2e%2e` is interpreted as `..` per the URL Standard, enabling path traversal to read arbitrary files from the backend.

## Details

The vulnerability is a conflict between two decoding stages:

**Stage 1 — `H3Event` constructor** (`src/event.ts:65-69`):

```typescript
if (url.pathname.includes("%")) {
  url.pathname = decodeURI(
    url.pathname.includes("%25") ? url.pathname.replace(/%25/g, "%2525") : url.pathname,
  );
}
```

This correctly preserves `%25` sequences by escaping them before decoding. A request for `/%252e%252e/etc/passwd` produces `event.url.pathname` = `/%2e%2e/etc/passwd` — the `%25` was preserved so `%252e` became `%2e` (not `.`).

**Stage 2 — `serveStatic`** (`src/utils/static.ts:86-88`):

```typescript
const originalId = resolveDotSegments(
  decodeURI(withLeadingSlash(withoutTrailingSlash(event.url.pathname))),
);
```

This applies a **second** `decodeURI()`, which decodes `%2e` → `.`, producing `/../../../etc/passwd`. However, the decoding happens *inside* the `resolveDotSegments()` call argument — `decodeURI` runs first, then `resolveDotSegments` processes the result.

Wait — re-examining the flow more carefully:

1. Input pathname after event.ts: `/%2e%2e/%2e%2e/etc/passwd`
2. `decodeURI()` in static.ts converts `%2e` → `.`, producing: `/../../../etc/passwd`
3. `resolveDotSegments("/../../../etc/passwd")` **does** resolve `..` segments, clamping to `/etc/passwd`

The actual bypass is subtler. `decodeURI()` does **not** decode `%2e` — it only decodes characters that `encodeURI` would encode. Since `.` is never encoded by `encodeURI`, `%2e` is **not** decoded by `decodeURI()`. So the chain is:

1. Request: `/%252e%252e/%252e%252e/etc/passwd`
2. After event.ts decode: `/%2e%2e/%2e%2e/etc/passwd`
3. `decodeURI()` in static.ts: `/%2e%2e/%2e%2e/etc/passwd` (unchanged — `decodeURI` doesn't decode `%2e`)
4. `resolveDotSegments()` fast-returns at line 56 because `%2e` contains no literal `.` character:
   ```typescript
   if (!path.includes(".")) {
     return path;
   }
   ```
5. Asset ID `/%2e%2e/%2e%2e/etc/passwd` is passed to `getMeta()` and `getContents()` callbacks
6. URL-based backends resolve `%2e%2e` as `..` per RFC 3986 / URL Standard

The root cause is `resolveDotSegments()` only checks for literal `.` characters and does not account for percent-encoded dot sequences (`%2e`). The `decodeURI()` in static.ts is redundant (event.ts already decodes) but is not the direct cause — the real gap is that `%2e%2e` survives as a traversal payload through both decoding stages and `resol