robfig/revel — pull request #127 by thequux (2013-04-07 06:36:23+00:00)
Title: Fixed an injection vulnerability in session management.

If any session key or value contains a null byte, then the part after
the null is parsed as a separate key/value pair. This fixes it for now
by disallowing null bytes; long term, it may be safer (and almost
certainly smaller) to precede the fields with a length.