rkh/rack-protection — pull request #15 by tyler (2012-01-16 09:52:22+00:00)
Title: Path traversal protection should allow empty segments

I ran into some trouble with your path traversal protection because it disallows empty segments in the url. Specifically, "http://mysite.com/http://someothersite.com" was being translated to "http://mysite.com/http:/someothersite.com". (Yes, believe it or not, the former is a valid url.)

I don't see any danger to allowing empty segments, though I recognize that there might be a danger that I don't immediately guess at. Also, according to RFC3986 sec 3.3, empty segments should be allowed. (Not that an RFC is the best reason for changing it, but hey...)