security(dav): align authorization-path decoding with RFC 3986 single-decode semantics

[seonghobae]

Problem

_normalize_dav_authorization_path() currently decodes the same string repeatedly until stable, bounded by 100 rounds. PR #1341 proposes changing only that bound to 4 and labels the existing 100-round bound a MEDIUM DoS vulnerability.

Fresh source review does not support that numeric-only remedy as a root-cause security fix:

• the 100-round loop was itself the repository's prior bounded DoS mitigation for the former unbounded loop;
• 🛡️ Sentinel: [MEDIUM] percent-decoding 루프 제한을 통한 DoS 취약점 수정 #1341 adds no regression or resource-bound test demonstrating a 100-round exploit or proving 4 as the correct boundary;
• RFC 3986 §2.4 states implementations must not percent-encode or decode the same string more than once, while §7.3 requires security checks after decoding the relevant component;
• CWE-174 treats double decoding as a weakness class. A smaller repeated-decoding count still preserves the same semantic ambiguity.

Required bounded slice

Design and test an authorization-path boundary that distinguishes framework/request-target decoding from application decoding and rejects ambiguous nested encodings instead of relying on an arbitrary recursive-unquote count. Preserve rejection of traversal (./..) and Windows separators, owner-scope isolation, and ordinary encoded path behavior.

Use TDD at the authorization boundary with at least:

• raw, singly encoded, and nested-encoded traversal attempts;
• percent-encoded percent signs that are legitimate data versus ambiguous second-pass encodings;
• mixed slash/backslash inputs;
• malformed percent triplets and hostile Unicode/control characters;
• a bounded long-input/resource test;
• route-level evidence that accounts for Starlette/FastAPI decoding before the path parameter reaches the helper.

Do not weaken fail-closed owner scoping or replace the issue with another arbitrary decode-round constant.

Primary references

Berners-Lee, T., Fielding, R., & Masinter, L. (2005). Uniform Resource Identifier (URI): Generic Syntax (RFC 3986), §§2.4, 7.3. RFC Editor. https://doi.org/10.17487/RFC3986

MITRE. (2025). CWE-174: Double Decoding of the Same Data (CWE 4.19/4.20 lineage). Common Weakness Enumeration.

Related: #1341.

[seonghobae]

#1344 implementation owner update (2026-09-10): PR #1645 is now correctly stacked on canonical #1417 (489bcbeaf131da123551a187228862b0e47ad549) instead of develop. Current exact head is 55068845c22c195c68e15429072cdb689245021a, Draft, effective scope 3 files.

Reality RED/fix lineage:

• c91988398414db3cd0226749aaa336c268543dbc: route-level RED for ASGI/framework decoding, nested traversal, legitimate %25 data, malformed raw triplets, encoded controls/invalid UTF-8, slash/backslash traversal and non-recursive long input.
• eafcc8d4720e58bb04d3029774e5c31f38a6e1e0: remove second application percent decode; validate raw request-target syntax before authorization.
• ASGI primary spec says path is percent/UTF-8 decoded and raw_path is original bytes but optional. b6931bf55a4a3320e103b417ee384c82f12444ac adds RED for missing raw_path with residual %; 42b5af38f21231aa4cad5f2e0ce0768f81fc1ee4 fails that ambiguous fallback closed.
• docs/doctoring/dav-authorization-path-decoding.md at current head records decision, invariants, exact evidence and APA 7th references (RFC 3986, ASGI, CWE-174).

Do not close this issue yet. Old 0bdaf4fe... workflow results are stale because they were admitted against former base develop. Current-head #1645 workflows are now materializing against the #1417 base; independent review is also requested. Acceptance still requires current (PR, base SHA, head SHA) terminal evidence, valid finding resolution, qualifying independent approval and prerequisite-first protected integration.