security: fix auth bypass via path-normalization mismatch (dot-segments)

The v2.0 auth pipeline interpreted the request path two different ways
that disagreed on ".." handling, letting an attacker reach a protected
handler with authentication skipped.

should_skip_auth() ran the path through normalize_path(), which collapses
"." / ".." segments, then matched it against auth_skip_paths. But the
route matcher (radix_tree::find via mr->standardized_url) and the regex
tier saw the raw path -- standardize_url() only collapses duplicate '/'
and a trailing '/', never dot-segments. On a failed descent the radix
walk falls back to the deepest matched prefix terminus.

So with a global auth_handler, a protected register_prefix("/admin") (or
"/admin/.*" regex) route, and auth_skip_paths({"/public/*"}):

    GET /admin/../public/x

normalized to "/public/x" for the auth-skip check (auth skipped) yet
still routed to the protected "/admin" prefix handler -- served
unauthenticated. (Requires a client that does not pre-normalize "..",
e.g. curl --path-as-is; MHD does not collapse dot-segments.)

Fix: canonicalize once, at the single point in answer_to_connection where
the routing/auth path is derived, by applying normalize_path() to the
standardized URL. The router, should_skip_auth(), and the route-cache key
now all interpret the path identically; the request above is uniformly
treated as "/public/x" and never reaches /admin. The extra normalize_path
in should_skip_auth() is now idempotent.

Adds an end-to-end regression test (auth_skip_dotdot_no_route_confusion)
that sends "/admin/../public/x" with CURLOPT_PATH_AS_IS and asserts the
protected handler is never reached; it fails on the pre-fix code with
ADMIN_SECRET != PUBLIC_OK.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NpysYDDJac63yz2mZKKiDf

Author: etr

src/detail/webserver_request.cpp

@@ -417,7 +417,20 @@ MHD_Result webserver_impl::answer_to_connection(void* cls, MHD_Connection* conne
 
     std::string t_url = url;
     base_unescaper(&t_url, impl->parent->unescaper);
-    mr->standardized_url = http_utils::standardize_url(t_url);
+    // SECURITY: collapse dot-segments ("." / "..") into the canonical
+    // path here, at the single point where the routing/auth path is
+    // derived. Both the route matcher (radix_tree::find via
+    // mr->standardized_url) and should_skip_auth() must interpret the
+    // path identically; should_skip_auth() runs the path through
+    // normalize_path() (which pops ".."), but standardize_url() only
+    // collapses duplicate '/' and a trailing '/'. Without this, a request
+    // such as "/admin/../public/x" normalizes to "/public/x" for the
+    // auth-skip check (auth skipped) yet the router still descends to the
+    // "/admin" prefix/regex handler -- an authentication bypass. Applying
+    // normalize_path() to the standardized URL makes the two views agree;
+    // it is idempotent w.r.t. the normalize_path() call already in
+    // should_skip_auth().
+    mr->standardized_url = normalize_path(http_utils::standardize_url(t_url));
     mr->has_body = false;
 
     // log_access is now a response_sent alias (see webserver_aliases.cpp).

test/integ/authentication.cpp

@@ -972,6 +972,71 @@ LT_BEGIN_AUTO_TEST(authentication_suite, auth_skip_paths_deep_nested)
     ws.stop();
 LT_END_AUTO_TEST(auth_skip_paths_deep_nested)
 
+// SECURITY REGRESSION (path-normalization auth bypass): the auth-skip
+// check and the route matcher must interpret the request path
+// identically. Before the fix, should_skip_auth() collapsed ".."
+// segments while the router did not, so "GET /admin/../public/x" looked
+// like "/public/x" to the auth gate (auth skipped) yet still descended
+// to the protected "/admin" prefix handler -- serving it unauthenticated.
+// After the fix the dispatch path canonicalizes the URL once (dot-
+// segments collapsed at answer_to_connection), so the same request is
+// uniformly treated as "/public/x": auth is legitimately skipped and it
+// routes to the public handler, never to /admin.
+//
+// CURLOPT_PATH_AS_IS is required -- libcurl collapses "/../" client-side
+// by default, which would mask the server-side behaviour under test.
+class admin_secret_resource : public http_resource {
+ public:
+     http_response render_get(const http_request&) {
+         return http_response::string("ADMIN_SECRET");
+     }
+};
+
+class public_ok_resource : public http_resource {
+ public:
+     http_response render_get(const http_request&) {
+         return http_response::string("PUBLIC_OK");
+     }
+};
+
+LT_BEGIN_AUTO_TEST(authentication_suite, auth_skip_dotdot_no_route_confusion)
+    webserver ws{create_webserver(0)
+        .auth_handler(centralized_auth_handler)
+        .auth_skip_paths({"/public/*"})};
+
+    ws.register_prefix("admin", std::make_shared<admin_secret_resource>());
+    ws.register_prefix("public", std::make_shared<public_ok_resource>());
+    ws.start(false);
+    const uint16_t port = ws.get_bound_port();
+
+    curl_global_init(CURL_GLOBAL_ALL);
+    std::string s;
+    CURL *curl = curl_easy_init();
+    CURLcode res;
+    long http_code = 0;  // NOLINT(runtime/int)
+
+    // Attacker path: normalizes to /public/x for the auth-skip check,
+    // but a pre-fix router would descend to the /admin prefix handler.
+    const std::string url =
+        "localhost:" + std::to_string(port) + "/admin/../public/x";
+    curl_easy_setopt(curl, CURLOPT_URL, url.c_str());
+    curl_easy_setopt(curl, CURLOPT_PATH_AS_IS, 1L);
+    curl_easy_setopt(curl, CURLOPT_HTTPGET, 1L);
+    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, writefunc);
+    curl_easy_setopt(curl, CURLOPT_WRITEDATA, &s);
+    res = curl_easy_perform(curl);
+    curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &http_code);
+    LT_ASSERT_EQ(res, 0);
+    // Must NOT reach the protected /admin handler unauthenticated.
+    LT_CHECK(s != "ADMIN_SECRET");
+    // Uniformly canonicalized to /public/x -> served by the public handler.
+    LT_CHECK_EQ(http_code, 200);
+    LT_CHECK_EQ(s, "PUBLIC_OK");
+    curl_easy_cleanup(curl);
+
+    ws.stop();
+LT_END_AUTO_TEST(auth_skip_dotdot_no_route_confusion)
+
 // Test POST method with centralized auth
 class post_resource : public http_resource {
  public: