fix: aim the public traversal test at the vector that reaches the guard

The counterfactual did not discriminate: removing the containment check
left the test green. `/public/%2E%2E/secret.txt` never enters the public
branch at all, because the WHATWG URL parser decodes `%2E%2E` and
normalises the dot segment away, so the request arrives as plain
`/secret.txt`. The test was observing nothing.

An encoded slash survives parsing intact, so `/public/..%2Fsecret.txt`
enters the branch with a path `join` then resolves outside appDir/public/,
which is what the guard is for. With that vector the test goes red when
the guard is removed.

The comment this was derived from asserted the opposite ("after URL
parsing, which doesn't touch %2E"), so correct it where it now lives
rather than carry an inaccurate claim into the extracted function.

Author: vivek7405

packages/server/src/dev.js

@@ -2106,14 +2106,17 @@ async function tryServePublicAsset(path, ctx) {
   const p = path === '/favicon.ico' ? '/public/favicon.ico' : (ROOT_ASSETS[path] || path);
   const abs = join(appDir, p);
   // Containment check. `join` normalises `..` segments, so a path
-  // like `/public/%2E%2E/secret/x.svg` decodes (after URL parsing,
-  // which doesn't touch `%2E`) to `/public/../secret/x.svg` and
-  // `join(appDir, ...)` resolves it to `appDir/secret/x.svg`. The
-  // resulting `abs` could be inside `appDir` but OUTSIDE `appDir/
-  // public/`, exposing files the user reasonably thought were
+  // like `/public/..%2Fsecret/x.svg` decodes to `/public/../secret/
+  // x.svg` and `join(appDir, ...)` resolves it to `appDir/secret/
+  // x.svg`. The resulting `abs` could be inside `appDir` but OUTSIDE
+  // `appDir/public/`, exposing files the user reasonably thought were
   // private under their non-public directories. Reject anything
   // that doesn't stay under `appDir/public/` (and the favicon
   // exception, which is already validated above).
+  // The live vector encodes the SLASH, not the dots: the WHATWG URL
+  // parser decodes `%2E%2E` and normalises the dot segment away, so a
+  // `/public/%2E%2E/x` request arrives here as plain `/x` and never
+  // enters this branch. `..%2F` survives parsing intact and does.
   const publicRoot = join(appDir, 'public') + sep;
   if (!abs.startsWith(publicRoot)) {
     return new Response(null, { status: 404 });

packages/server/test/dev/public-before-analysis.test.js

@@ -113,12 +113,21 @@ test('root middleware does not run for /public/* in dev, and does in prod', asyn
 });
 
 // COUNTERFACTUAL: drop the containment check from `tryServePublicAsset` and this
-// serves the file, which is a directory-traversal hole.
+// serves the file, which is a directory-traversal hole. Verified 2026-08-12 at
+// 915c662d by removing the guard and watching this go red.
+//
+// The vector has to use an encoded SLASH (`..%2F`), not encoded dots. The
+// WHATWG URL parser decodes `%2E%2E` to `..` and then normalises the dot
+// segment away, so `/public/%2E%2E/secret.txt` arrives as `/secret.txt` and
+// never enters the public branch at all: asserting on it would pass with the
+// guard removed, which is a test that observes nothing. `..%2F` survives
+// parsing intact, so the branch is entered with a path that `join` then
+// resolves outside `appDir/public/`, which is exactly what the guard is for.
 test('the traversal guard travels with the moved code (dev early path)', async () => {
   const appDir = makeApp();
   writeFileSync(join(appDir, 'secret.txt'), 'nope\n');
   const app = await createRequestHandler({ appDir, dev: true });
-  const res = await app.handle(new Request('http://x/public/%2E%2E/secret.txt'));
+  const res = await app.handle(new Request('http://x/public/..%2Fsecret.txt'));
   assert.equal(res.status, 404, 'a path that escapes appDir/public/ is refused');
   assert.notEqual(await res.text(), 'nope\n');
 });