rails/rails — pull request #5456 by brianmario (2012-03-15 21:52:40+00:00)
Title: Strip null bytes from Location header

This strips null bytes off of the `Location` header in addition to `\r\n` which are already being stripped.

This is in response to a recent _nasty_ security [vulnerability in nginx](http://mailman.nginx.org/pipermail/nginx-announce/2012/000076.html). I figure it's probably easier for people to get this patch in their Rails applications than it is for them to get nginx upgraded in their infrastructure - which may or may not even be managed by them.

I'd like to get this into all supported Rails versions, not sure if this patch will apply cleanly to 3.1 or 3.0 - let me know if not and I'll send some others.