pypa/pip — pull request #997 by CharString (2013-06-15 02:28:42+00:00)
Title: Sanitize Content-Disposition; filename

As defined in http://tools.ietf.org/html/rfc2183#section-2.3 this removes
directory separators from filename hints in http_responses.

Perhaps more sanitizing is needed. This pull introduces a location where those checks can go.