sstephenson/sprockets — pull request #292 by jfirebaugh (2012-02-09 03:20:39+00:00)
Title: Check for directory traversal after unescaping

The `forbidden_request?` check could be trivially bypassed by percent
encoding .. as %2e%2e.

After auditing Sprockets and Hike and fuzzing a simple server, I don't
believe this is exploitable. However, better safe than sorry/defense in
depth/etc.