fix: validate webhook signatures on percent-encoded request paths

[manisha1997]

Problem

Rack::TwilioWebhookAuthentication decided whether to validate a request by matching the configured
patterns against the raw PATH_INFO, which is still percent-encoded. The routers this middleware
sits in front of — Rails' Journey, Sinatra — decode and normalize the path before matching their own
routes, so the two disagreed about which path had been requested.

On a disagreement the middleware failed open: it passed the request to the app without validating
its signature, while the router still dispatched it to the guarded action.

Fix

Match the configured patterns against each form the path can take by the time it reaches the router
— raw, percent-decoded, and with dot segments and repeated slashes collapsed — and validate if any
of them matches.

Matching on any candidate is deliberate: it can only widen the set of validated requests, so an
integration that works today cannot silently lose its protection. The failure mode inverts from
"wave it through" to "check it".

Three details worth a reviewer's attention:

• Rack::Utils.unescape_path, not unescape. The latter is form decoding and turns + into a
  space; in a path a plus is a literal plus.
• Invalid UTF-8 is scrubbed. %FF%FE decodes to bytes that make String#match raise
  ArgumentError, which would be an unhandled 500 on a hostile path.
• Single decode, not repeated. This matches what Rails actually does — %256F decodes to a
  literal %6F and routes to /%6Fice, not /voice — so decoding twice would over-match.

original_url, used for the signature computation itself, is deliberately untouched. It has a
related encoding mismatch, but changing what gets signed risks breaking integrations that work
today, and it is unreachable while the path gate holds. Worth its own decision.

Tests

10 regression specs covering percent-encoded paths, encoded slashes, dot segments against an
anchored pattern, undecodable bytes, literal +, and the negative cases that must still pass
through unvalidated.

Full suite green (377 examples, 0 failures); Rubocop clean on both files.

Notes

Tracked internally as SECOPS-25944. Affects current releases, not only the version named in the
report. Maintainers may want to consider a CVE and a GitHub Security Advisory alongside the release
that carries this.

🤖 Generated with Claude Code

[manisha1997]

https://github.com/twilio/twilio-ruby/actions/runs/34376103570