fix(codemode): block encoded dot-segment escape

Path traversal via percent-encoded dot-segments still bypassed the
BACKEND_URL prefix check. RFC 3986 §3.3 treats "%2e" as identical to
".", so URL normalisation collapsed "/api/%2e%2e/admin" to "/admin"
before any request-time check ran.

buildUrl now decodeURIComponent()s each path segment before checking
for "." / ".." and rejects invalid percent-encoding outright.

Tests added: %2e%2e, %2E%2e (mixed case), %2e. (partial), %ZZ
(invalid encoding). 28/28 bun pass.

Author: pratikbin

codemode/workerd/api-proxy.js

@@ -78,13 +78,21 @@ function buildUrl(base, path, query) {
   if (typeof path !== "string" || !path.startsWith("/") || path.startsWith("//")) {
     throw new Error("path must be a server-relative path starting with '/'");
   }
-  // Reject dot-segments. URL normalisation collapses "/api/../admin" to
-  // "/admin", which would let user code escape any BACKEND_URL path
-  // prefix and reach unrelated routes.
+  // Reject dot-segments — both raw and percent-encoded. URL normalisation
+  // collapses "/api/../admin" (and "/api/%2e%2e/admin", "/api/%2E./admin",
+  // etc., because RFC 3986 §3.3 treats percent-encoded "." as identical
+  // to literal ".") to "/admin", which would let user code escape any
+  // BACKEND_URL path prefix and reach unrelated routes.
   const [pathOnly, reqQuery] = path.split("?", 2);
   for (const seg of pathOnly.split("/")) {
-    if (seg === "." || seg === "..") {
-      throw new Error("path may not contain '.' or '..' segments");
+    let decoded;
+    try {
+      decoded = decodeURIComponent(seg);
+    } catch {
+      throw new Error("path contains invalid percent-encoding");
+    }
+    if (decoded === "." || decoded === "..") {
+      throw new Error("path may not contain '.' or '..' segments (raw or encoded)");
     }
   }
   const baseUrl = new URL(base);

codemode/workerd/test/api-proxy.test.js

@@ -133,6 +133,86 @@ describe("api-proxy", () => {
     expect(called).toBe(false);
   });
 
+  test("rejects percent-encoded dot-segment ('/%2e%2e/admin')", async () => {
+    let called = false;
+    globalThis.fetch = mock(async () => { called = true; return new Response("nope"); });
+    const r = await apiProxy.fetch(
+      new Request("https://internal/proxy", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          mode: "authenticated",
+          method: "GET",
+          path: "/%2e%2e/admin",
+          authCtx: { apiKey: "k" },
+        }),
+      }),
+      { BACKEND_URL: "https://backend.test/api" },
+    );
+    expect(r.status).toBe(400);
+    expect(called).toBe(false);
+  });
+
+  test("rejects mixed-case encoded dot-segment ('/%2E%2e/admin')", async () => {
+    let called = false;
+    globalThis.fetch = mock(async () => { called = true; return new Response("nope"); });
+    const r = await apiProxy.fetch(
+      new Request("https://internal/proxy", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          mode: "authenticated",
+          method: "GET",
+          path: "/%2E%2e/admin",
+          authCtx: { apiKey: "k" },
+        }),
+      }),
+      { BACKEND_URL: "https://backend.test/api" },
+    );
+    expect(r.status).toBe(400);
+    expect(called).toBe(false);
+  });
+
+  test("rejects partial-encoded dot-segment ('/%2e./admin')", async () => {
+    let called = false;
+    globalThis.fetch = mock(async () => { called = true; return new Response("nope"); });
+    const r = await apiProxy.fetch(
+      new Request("https://internal/proxy", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          mode: "authenticated",
+          method: "GET",
+          path: "/%2e./admin",
+          authCtx: { apiKey: "k" },
+        }),
+      }),
+      { BACKEND_URL: "https://backend.test/api" },
+    );
+    expect(r.status).toBe(400);
+    expect(called).toBe(false);
+  });
+
+  test("rejects invalid percent-encoding ('/%ZZ/admin')", async () => {
+    let called = false;
+    globalThis.fetch = mock(async () => { called = true; return new Response("nope"); });
+    const r = await apiProxy.fetch(
+      new Request("https://internal/proxy", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          mode: "authenticated",
+          method: "GET",
+          path: "/%ZZ/admin",
+          authCtx: { apiKey: "k" },
+        }),
+      }),
+      { BACKEND_URL: "https://backend.test/api" },
+    );
+    expect(r.status).toBe(400);
+    expect(called).toBe(false);
+  });
+
   test("rejects dot-segment in middle of path ('/v1/foo/../../admin')", async () => {
     let called = false;
     globalThis.fetch = mock(async () => { called = true; return new Response("nope"); });