files: percent-decode url path

actix-files/Cargo.toml

@@ -35,3 +35,4 @@ percent-encoding = "2.1"
 actix-rt = "2.2"
 actix-web = "4.0.0-beta.9"
 actix-test = "0.1.0-beta.3"
+tempfile = "3.2"

actix-files/src/lib.rs

@@ -787,6 +787,29 @@ mod tests {
         assert_eq!(res.status(), StatusCode::OK);
     }
 
+    #[actix_rt::test]
+    async fn test_percent_encoding_2() {
+        let tmpdir = tempfile::tempdir().unwrap();
+        let filename = match cfg!(unix) {
+            true => "ض:?#[]{}<>()@!$&'`|*+,;= %20.test",
+            false => "ض#[]{}()@!$&'`+,;= %20.test",
+        };
+        let filename_encoded = filename
+            .as_bytes()
+            .iter()
+            .map(|c| format!("%{:02X}", c))
+            .collect::<String>();
+        std::fs::File::create(tmpdir.path().join(filename)).unwrap();
+
+        let srv = test::init_service(App::new().service(Files::new("", tmpdir.path()))).await;
+
+        let req = TestRequest::get()
+            .uri(&format!("/{}", filename_encoded))
+            .to_request();
+        let res = test::call_service(&srv, req).await;
+        assert_eq!(res.status(), StatusCode::OK);
+    }
+
     #[actix_rt::test]
     async fn test_serve_named_file() {
         let srv =

actix-files/src/service.rs

@@ -77,11 +77,13 @@ impl Service<ServiceRequest> for FilesService {
             )));
         }
 
-        let real_path =
+        let path_decoded =
-            match PathBufWrap::parse_path(req.match_info().path(), self.hidden_files) {
+            percent_encoding::percent_decode_str(req.match_info().path()).decode_utf8_lossy();
-                Ok(item) => item,
+
-                Err(e) => return Box::pin(ok(req.error_response(e))),
+        let real_path = match PathBufWrap::parse_path(&path_decoded, self.hidden_files) {
-            };
+            Ok(item) => item,
+            Err(e) => return Box::pin(ok(req.error_response(e))),
+        };
 
         if let Some(filter) = &self.path_filter {
             if !filter(real_path.as_ref(), req.head()) {