Reject dot-segment traversal paths

src/Http/Controllers/PassageController.php

@@ -55,6 +55,10 @@ public function handle(Request $request): Response
             return response()->json(['error' => 'Route not found'], Response::HTTP_NOT_FOUND);
         }
 
+        if ($this->containsDotSegment($path)) {
+            return response()->json(['error' => 'Invalid path'], Response::HTTP_BAD_REQUEST);
+        }
+
         $handlerInstance = $this->app->make($handler);
         $mergedOptions = array_merge(config('passage.options', []), $handlerInstance->getOptions());
 
@@ -175,4 +179,22 @@ private function fireEvent(object $event): void
             Event::dispatch($event);
         }
     }
+
+    private function containsDotSegment(string $path): bool
+    {
+        $decoded = str_replace('\\', '/', $path);
+
+        do {
+            foreach (explode('/', $decoded) as $segment) {
+                if ($segment === '.' || $segment === '..') {
+                    return true;
+                }
+            }
+
+            $previous = $decoded;
+            $decoded = rawurldecode($decoded);
+        } while ($decoded !== $previous);
+
+        return false;
+    }
 }

tests/Unit/PassageControllerTest.php

@@ -243,8 +243,8 @@ function jsonUpstreamResponse(array $data, int $status = 200): Response
         $this->controller->handle($request);
     });
 
-    it('extracts the path route parameter as the forwarded URI', function () {
-        $request = Request::create('/github/users/morcen/repos', 'GET');
+    it('extracts a safe path with dots as the forwarded URI', function () {
+        $request = Request::create('/github/v1.2/.well-known/file..name', 'GET');
         $route = (new Route(['GET'], '/github/{path?}', []))
             ->defaults('_passage_handler', TestPassageController::class)
             ->where('path', '.*');
@@ -258,14 +258,39 @@ function jsonUpstreamResponse(array $data, int $status = 200): Response
 
         $this->mockPassageService->shouldReceive('callService')
             ->withArgs(function (Request $req, $pending, string $uri) {
-                return $uri === 'users/morcen/repos';
+                return $uri === 'v1.2/.well-known/file..name';
             })
             ->once()
             ->andReturn($mockResponse);
 
         $this->controller->handle($request);
     });
 
+    it('rejects dot-segment traversal before creating an upstream request', function (string $path) {
+        $request = Request::create('/github/safe', 'GET');
+        $route = (new Route(['GET'], '/github/{path?}', []))
+            ->defaults('_passage_handler', TestPassageController::class)
+            ->where('path', '.*');
+        $route->bind($request);
+        $route->setParameter('path', $path);
+        $request->setRouteResolver(fn () => $route);
+
+        Http::shouldReceive('withOptions')->never();
+        $this->mockPassageService->shouldReceive('callService')->never();
+
+        $response = $this->controller->handle($request);
+
+        expect($response->getStatusCode())->toBe(ResponseCode::HTTP_BAD_REQUEST);
+        expect($response->getData(true))->toBe(['error' => 'Invalid path']);
+    })->with([
+        'literal parent segment' => '../private',
+        'nested parent segment' => 'public/../private',
+        'percent-encoded parent segment' => '%2e%2e/private',
+        'mixed-encoded parent segment' => '%2E./private',
+        'encoded separator after parent segment' => '%2e%2e%2fprivate',
+        'double-encoded parent segment' => '%252e%252e/private',
+    ]);
+
     it('applies response transformation', function () {
         $request = Request::create('/enriched/posts', 'GET');
         $route = (new Route(['GET'], '/enriched/{path?}', []))