Byass due to validation before canonicalization in serve

Summary

Versions of `serve` before 6.5.2 are vulnerable to the bypass of the ignore functionality. The bypass is possible because validation happens before canonicalization of paths and filenames. Example: Here we have a server that ignores the file test.txt. ``` const serve = require('serve') const server = serve(__dirname, { port: 1337, ignore: ['test.txt'] }) ``` Using the URL encoded form of a letter (%65 instead of e) attacker can bypass the ignore control accessing the file. `curl http://localhost:1337/t%65st.txt` Additionally this technique can be used to get directory listings of ignored directories. ## Recommendation Update to version 6.5.2 or later.