GHSA-crq5-92j2-j7wv

The static content handlers `ResourceService` and `WebjarService` URL decode each path segment and then reject only segments that are exactly `""`, `"."`, or `".."`. A percent-encoded separator (`%2F`) lets an attacker smuggle a `../` segment past that filter and escape the configured base, reading resources that should not be public.

On Windows, a similar attack exists with (`%5C`).

## Impact

Disclosure of classpath or webjar resources outside the configured base.

## Preconditions

- Application uses `ResourceService` (with a non-root base path) or `WebjarService` - At least one classpath entry is served from a directory (e.g. `sbt run`, exploded .war) - Backend forwards `%2F`/`%5C` without normalizing (e.g., Ember, Blaze)

## Fixes

The patch rejects any decoded path segment containing `/` (`%2F`) or `\` (`%5C`) with a `400 Bad Request` in `ResourceService` and `WebjarService`.

`FileService` was not exploitable, but the same guards are applied for consistency and to remove its reliance on path normalization.

## Workarounds

- Deploy as a fat jar, with no filesystem directories on the classpath. - Front the service with a proxy that rejects/normalizes `%2F` and `%5C` in the request path.