fix(request): handle "double dots" in URL

[yusukebe]

Fixes #123

Since v1.3.0, we use our own Request object. This is great, but the url behavior is unexpected.

In the standard API, if the URL contains .., here called "double dots", the URL string returned by Request will be in the resolved path.

const req = new Request('http://localhost/static/../foo.txt') // Web-standards
console.log(req.url) // /http://localhost/foo.txt

However, our url as implemented below does not resolve double dots, so http://localhost/static/.. /foo.txt is returned.

node-server/src/request.ts

Lines 43 to 45 in 8cea466

	get url() {
	return `http://${this[incomingKey].headers.host}${this[incomingKey].url}`
	},

This causes vulnerabilities like #123 when using serveStatic.

So this must be fixed immediately. This PR solves that. The path will be checked on every request, which may have a performance impact but must be allowed for.

[yusukebe]

Hi @usualoma !

I wanted to have this PR reviewed, but since it should be released soon, I am merging it. I think the behavior is fine, and if you can improve the performance, I would like you to create another PR.