- Shipped
- September 8, 2026 at 1:51 AM UTC
- Author
- Kamo
- Commit
- 53edef7
The catch-all re-encodes each segment, and the comment claimed that meant it could only ever address the chess API. `encodeURIComponent('..')` is `'..'` — dots are not encoded — and the URL parser inside fetch resolves the segment, so `chess/../sessions/x` would have left the prefix for another of MediaService's controllers. Bounded rather than dangerous: the OTK is the caller's own session and every endpoint enforces its own auth, so nothing is reachable that the caller could not already reach through its own route. But it made a claim in the comment false, and that claim is the kind a reader relies on when deciding this file is safe to leave alone. Segments of '', '.' and '..' are refused outright now. Nothing legitimate is lost: every chess path is fixed words, UUIDs and numeric member ids.