Byass due to validation before canonicalization in serve
Versions of `serve` before 6.5.2 are vulnerable to the bypass of the ignore functionality. The bypass is possible because validation happens before canonicalization of paths and filenames.Example:
Here we have a server that ignores the file test.txt.Using the URL encoded form of a letter (%65 instead of e) attacker can bypass the ignore control accessing the file.`curl http://localhost:1337/t%65st.txt`Additionally this technique can be used to get directory listings of ignored directories.RecommendationUpdate to version 6.5.2 or later.