Http4s: ResourceService and Webjar Service path escape via percent-encoded separators

The static content handlers ResourceService and WebjarService URL decode each path segment and then reject only segments that are exactly "", ".", or "..". A percent-encoded separator (%2F) lets an attacker smuggle a ../ segment past that filter and escape the configured base, reading resources that should not be public.

On Windows, a similar attack exists with (%5C).

Impact

Disclosure of classpath or webjar resources outside the configured base.

Preconditions

• Application uses ResourceService (with a non-root base path) or WebjarService
• At least one classpath entry is served from a directory (e.g. sbt run, exploded .war)
• Backend forwards %2F/%5C without normalizing (e.g., Ember, Blaze)

Fixes

The patch rejects any decoded path segment containing / (%2F) or \ (%5C) with a 400 Bad Request in ResourceService and WebjarService.

FileService was not exploitable, but the same guards are applied for consistency and to remove its reliance on path normalization.

Workarounds

• Deploy as a fat jar, with no filesystem directories on the classpath.
• Front the service with a proxy that rejects/normalizes %2F and %5C in the request path.