Refuse a ':' in a path a mount point serves on Windows (#2643)

On NTFS a ':' in a path names a stream of the file, so /dir/test.html::$DATA opened the default stream of dir/test.html and passed a set_pre_routing_handler() guard on /dir/test.html, and /setup.exe:Zone.Identifier served the stream Windows attaches to downloaded files. is_valid_path() now refuses a ':' on Windows.

Elsewhere a ':' is an ordinary file name character, so it is still served: a file such as 2024-01-01T10:00:00.log would otherwise answer 404. The test pins both sides.

test/test.cc

@@ -707,6 +707,18 @@ TEST(IsValidPathTest, RejectsSegmentsEndingInDotOrSpace) {
   }
 }
 
+// ':' names an NTFS stream on Windows and is an ordinary character in a file
+// name anywhere else.
+TEST(IsValidPathTest, ColonIsRejectedOnlyOnWindows) {
+  for (auto path : {"/a.txt::$DATA", "/a.txt:Zone.Identifier", "/dir:x/a"}) {
+#ifdef _WIN32
+    EXPECT_FALSE(detail::is_valid_path(path)) << path;
+#else
+    EXPECT_TRUE(detail::is_valid_path(path)) << path;
+#endif
+  }
+}
+
 TEST(CanCompressContentTypeTest, ComparesWholeTypes) {
   EXPECT_TRUE(detail::can_compress_content_type("application/json"));
   EXPECT_TRUE(detail::can_compress_content_type("text/plain; charset=utf-8"));
@@ -12760,7 +12772,8 @@ TEST(MountTest, AliasedPathDoesNotPassPreRoutingGuard) {
   for (auto path :
        {"/./dir/test.html", "/dir/./test.html", "//dir/test.html",
         "/dir//test.html", "/dir/../dir/test.html", "/%2e/dir/test.html",
-        "/dir/test.html.", "/dir/test.html%20"}) {
+        "/dir/test.html.", "/dir/test.html%20", "/dir/test.html::$DATA",
+        "/dir/test.html%3A%3A$DATA"}) {
     SCOPED_TRACE(path);
     auto res = cli.Get(path);
     ASSERT_TRUE(res) << "Error: " << to_string(res.error());