GHSA-crq5-92j2-j7wv Http4s: ResourceService and Webjar Service path escape via percent-encoded separators

• Maven org.http4s:http4s-server_2.12: < 0.23.35 → fixed in 0.23.35 • Maven org.http4s:http4s-server_2.13: < 0.23.35 → fixed in 0.23.35 • Maven org.http4s:http4s-server_3: < 0.23.35 → fixed in 0.23.35 • Maven org.http4s:http4s-server_3: >= 1.0.0-M1, < 1.0.0-M47 → fixed in 1.0.0-M47 • Maven org.http4s:http4s-server_2.13: >= 1.0.0-M1, < 1.0.0-M47 → fixed in 1.0.0-M47

The static content handlers `ResourceService` and `WebjarService` URL decode each path segment and then reject only segments that are exactly `""`, `"."`, or `".."`. A percent-encoded separator (`%2F`) lets an attacker smuggle a `../` segment past that filter and escape the configured base, reading resources that should not be public. On Windows, a similar attack exists with (`%5C`). Impact Disclosure of classpath or webjar resources outside the configured base. Preconditions • Application uses `ResourceService` (with a non-root base path) or `WebjarService` • At least one classpath entry is served from a directory (e.g. `sbt run`, exploded .war) • Backend forwards `%2F`/`%5C` without normalizing (e.g., Ember, Blaze) Fixes The patch rejects any decoded path segment containing `/` (`%2F`) or `\` (`%5C`) with a `400 Bad Request` in `ResourceService` and `WebjarService`. `FileService` was not exploitable, but the same guards are applied for consistency and to remove its reliance on path normalization. Workarounds • Deploy as a fat jar, with no filesystem directories on the classpath. • Front the service with a proxy that rejects/normalizes `%2F` and `%5C` in the request path.