From bdd4a1fc9e0dcfd6e588ea6ab25fac7ecf6a5239 Mon Sep 17 00:00:00 2001
From: Chetan Padia <chetbox@users.noreply.github.com>
Date: Thu, 2 May 2024 10:56:13 +0100
Subject: [PATCH 1/4] Add a test file with a percent in the filename

---
 test/dir-list.test.js | 10 ++++++----
 test/static/100%.txt  |  1 +
 2 files changed, 7 insertions(+), 4 deletions(-)
 create mode 100644 test/static/100%.txt

diff --git a/test/dir-list.test.js b/test/dir-list.test.js
index b6e7b56e..669b85df 100644
--- a/test/dir-list.test.js
+++ b/test/dir-list.test.js
@@ -154,7 +154,7 @@ t.test('dir list, custom options', t => {
   }
 
   const route = '/public/'
-  const content = { dirs: ['deep', 'shallow'], files: ['.example', 'a .md', 'foo.html', 'foobar.html', 'index.css', 'index.html'] }
+  const content = { dirs: ['deep', 'shallow'], files: ['.example', '100%.txt', 'a .md', 'foo.html', 'foobar.html', 'index.css', 'index.html'] }
 
   helper.arrange(t, options, (url) => {
     t.test(route, t => {
@@ -205,6 +205,7 @@ t.test('dir list html format', t => {
 </ul>
 <ul>
   <li><a href="/public/.example" target="_blank">.example</a></li>
+  <li><a href="/public/100%.txt" target="_blank">100%.txt</a></li>
   <li><a href="/public/a .md" target="_blank">a .md</a></li>
   <li><a href="/public/foo.html" target="_blank">foo.html</a></li>
   <li><a href="/public/foobar.html" target="_blank">foobar.html</a></li>
@@ -236,6 +237,7 @@ t.test('dir list html format', t => {
 </ul>
 <ul>
   <li><a href="/public/.example" target="_blank">.example</a></li>
+  <li><a href="/public/100%.txt" target="_blank">100%.txt</a></li>
   <li><a href="/public/a .md" target="_blank">a .md</a></li>
   <li><a href="/public/foo.html" target="_blank">foo.html</a></li>
   <li><a href="/public/foobar.html" target="_blank">foobar.html</a></li>
@@ -492,7 +494,7 @@ t.test('json format with url parameter format', t => {
     }
   }
   const route = '/public/'
-  const jsonContent = { dirs: ['deep', 'shallow'], files: ['.example', 'a .md', 'foo.html', 'foobar.html', 'index.css', 'index.html'] }
+  const jsonContent = { dirs: ['deep', 'shallow'], files: ['.example', '100%.txt', 'a .md', 'foo.html', 'foobar.html', 'index.css', 'index.html'] }
 
   helper.arrange(t, options, (url) => {
     simple.concat({
@@ -539,7 +541,7 @@ t.test('json format with url parameter format and without render option', t => {
     }
   }
   const route = '/public/'
-  const jsonContent = { dirs: ['deep', 'shallow'], files: ['.example', 'a .md', 'foo.html', 'foobar.html', 'index.css', 'index.html'] }
+  const jsonContent = { dirs: ['deep', 'shallow'], files: ['.example', '100%.txt', 'a .md', 'foo.html', 'foobar.html', 'index.css', 'index.html'] }
 
   helper.arrange(t, options, (url) => {
     simple.concat({
@@ -588,7 +590,7 @@ t.test('html format with url parameter format', t => {
     }
   }
   const route = '/public/'
-  const jsonContent = { dirs: ['deep', 'shallow'], files: ['.example', 'a .md', 'foo.html', 'foobar.html', 'index.css', 'index.html'] }
+  const jsonContent = { dirs: ['deep', 'shallow'], files: ['.example', '100%.txt', 'a .md', 'foo.html', 'foobar.html', 'index.css', 'index.html'] }
 
   helper.arrange(t, options, (url) => {
     simple.concat({
diff --git a/test/static/100%.txt b/test/static/100%.txt
new file mode 100644
index 00000000..4dd6a5cb
--- /dev/null
+++ b/test/static/100%.txt
@@ -0,0 +1 @@
+100%

From 03c18ccc4b18d91116cada64744afbaedc555679 Mon Sep 17 00:00:00 2001
From: Chetan Padia <chetbox@users.noreply.github.com>
Date: Thu, 2 May 2024 11:10:56 +0100
Subject: [PATCH 2/4] Fix `href` encoding in directory listing

---
 lib/dirList.js        | 2 +-
 test/dir-list.test.js | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/lib/dirList.js b/lib/dirList.js
index 09c2fdfe..4afeb60c 100644
--- a/lib/dirList.js
+++ b/lib/dirList.js
@@ -149,7 +149,7 @@ const dirList = {
       route = path.normalize(path.join(route, '..'))
     }
     return {
-      href: path.join(prefix, route, entry.name).replace(/\\/gu, '/'),
+      href: encodeURI(path.posix.join(prefix, route, entry.name)),
       name: entry.name,
       stats: entry.stats,
       extendedInfo: entry.extendedInfo
diff --git a/test/dir-list.test.js b/test/dir-list.test.js
index 669b85df..7d42202b 100644
--- a/test/dir-list.test.js
+++ b/test/dir-list.test.js
@@ -205,8 +205,8 @@ t.test('dir list html format', t => {
 </ul>
 <ul>
   <li><a href="/public/.example" target="_blank">.example</a></li>
-  <li><a href="/public/100%.txt" target="_blank">100%.txt</a></li>
-  <li><a href="/public/a .md" target="_blank">a .md</a></li>
+  <li><a href="/public/100%25.txt" target="_blank">100%.txt</a></li>
+  <li><a href="/public/a%20.md" target="_blank">a .md</a></li>
   <li><a href="/public/foo.html" target="_blank">foo.html</a></li>
   <li><a href="/public/foobar.html" target="_blank">foobar.html</a></li>
   <li><a href="/public/index.css" target="_blank">index.css</a></li>
@@ -237,8 +237,8 @@ t.test('dir list html format', t => {
 </ul>
 <ul>
   <li><a href="/public/.example" target="_blank">.example</a></li>
-  <li><a href="/public/100%.txt" target="_blank">100%.txt</a></li>
-  <li><a href="/public/a .md" target="_blank">a .md</a></li>
+  <li><a href="/public/100%25.txt" target="_blank">100%.txt</a></li>
+  <li><a href="/public/a%20.md" target="_blank">a .md</a></li>
   <li><a href="/public/foo.html" target="_blank">foo.html</a></li>
   <li><a href="/public/foobar.html" target="_blank">foobar.html</a></li>
   <li><a href="/public/index.css" target="_blank">index.css</a></li>

From 529a2ac7a26ff06414e9b694f8026e9971877454 Mon Sep 17 00:00:00 2001
From: Chetan Padia <chetbox@users.noreply.github.com>
Date: Thu, 2 May 2024 11:16:17 +0100
Subject: [PATCH 3/4] Fix for filename with `%` in their filename

---
 index.js            |  3 ++-
 test/static.test.js | 27 +++++++++++++++++++++++++++
 2 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/index.js b/index.js
index cfa6cb13..f2251fc7 100644
--- a/index.js
+++ b/index.js
@@ -221,7 +221,8 @@ async function fastifyStatic (fastify, opts) {
       }
     }
 
-    const stream = send(request.raw, pathnameForSend, options)
+    // `send(..., path, ...)` will URI-decode path so we pass an encoded path here
+    const stream = send(request.raw, encodeURI(pathnameForSend), options)
     let resolvedFilename
     stream.on('file', function (file) {
       resolvedFilename = file
diff --git a/test/static.test.js b/test/static.test.js
index 0bbe485a..3a3bb760 100644
--- a/test/static.test.js
+++ b/test/static.test.js
@@ -3963,6 +3963,33 @@ t.test(
   }
 )
 
+t.test(
+  'serves files with % in the filename',
+  async (t) => {
+    t.plan(2)
+
+    const txtContent = fs.readFileSync(path.join(__dirname, 'static', '100%.txt'), 'utf-8')
+
+    const pluginOptions = {
+      root: url.pathToFileURL(path.join(__dirname, '/static')),
+      wildcard: false
+    }
+
+    const fastify = Fastify()
+
+    fastify.register(fastifyStatic, pluginOptions)
+    const response = await fastify.inject({
+      method: 'GET',
+      url: '100%25.txt',
+      headers: {
+        'accept-encoding': '*, *'
+      }
+    })
+    t.equal(response.statusCode, 200)
+    t.same(response.body, txtContent)
+  }
+)
+
 t.test('content-length in head route should not return zero when using wildcard', t => {
   t.plan(6)
 

From e7a845d7f87743691597a86ac29c727207e91538 Mon Sep 17 00:00:00 2001
From: Chetan Padia <chetbox@users.noreply.github.com>
Date: Thu, 2 May 2024 11:35:25 +0100
Subject: [PATCH 4/4] Reinstate `path.join` workaround for Windows

---
 lib/dirList.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/dirList.js b/lib/dirList.js
index 4afeb60c..7a9cd3f6 100644
--- a/lib/dirList.js
+++ b/lib/dirList.js
@@ -149,7 +149,7 @@ const dirList = {
       route = path.normalize(path.join(route, '..'))
     }
     return {
-      href: encodeURI(path.posix.join(prefix, route, entry.name)),
+      href: encodeURI(path.join(prefix, route, entry.name).replace(/\\/gu, '/')),
       name: entry.name,
       stats: entry.stats,
       extendedInfo: entry.extendedInfo