exclude %encoded /

Author: bourgeoa

lib/resource-mapper.js

@@ -82,9 +82,7 @@ class ResourceMapper {
 
     // Determine the URL by chopping off everything after the dollar sign
     const pathname = this._removeDollarExtension(path)
-    const url = `${this.resolveUrl(hostname)}${
-      pathname.split('/').map((component) => encodeURIComponent(component)).join('/')
-    }`
+    const url = `${this.resolveUrl(hostname)}${this._encodePath(pathname)}`
     return { url, contentType: this._getContentTypeFromExtension(path) }
   }
 
@@ -95,7 +93,7 @@ class ResourceMapper {
     contentType = contentType ? contentType.replace(/\s*;.*/, '') : ''
     // Parse the URL and find the base file path
     const { pathname, hostname } = this._parseUrl(url)
-    const filePath = this.resolveFilePath(hostname, decodeURIComponent(pathname))
+    const filePath = this.resolveFilePath(hostname, this._decodePath(pathname))
     if (filePath.indexOf('/..') >= 0) {
       throw new Error('Disallowed /.. segment in URL')
     }
@@ -149,6 +147,25 @@ class ResourceMapper {
     return { path, contentType: contentType || this._defaultContentType }
   }
 
+  // encode/decode path except slash/%encodedSlash/double%encodedSlash
+  _exceptSlash () { return /(\/|%2f|%2F|%252F|%252f)/g }
+
+  _encodePath (pathname) {
+    const pathArray = pathname.split(this._exceptSlash())
+    pathArray.forEach((el, i) => {
+      if (i % 2 === 0) pathArray[i] = encodeURIComponent(el)
+    })
+    return pathArray.join('')
+  }
+
+  _decodePath (pathname) {
+    const pathArray = pathname.split(this._exceptSlash())
+    pathArray.forEach((el, i) => {
+      if (i % 2 === 0) pathArray[i] = decodeURIComponent(el)
+    })
+    return pathArray.join('')
+  }
+
   // Parses a URL into hostname and pathname
   _parseUrl (url) {
     // URL specified as string