yahoo/express-combo — pull request #2 by isao (2013-07-19 17:06:06+00:00)
Title: check normalize() restricts access to root parent dirs

add two tests that check the path used for combo urls like:

- not allowed: /combo?/public/../../README.md
- is allowed: /combo?/public/../fixtures/robot.txt

note: I don't think allowing "../" in a combo url should be supported, if only because of the increased length.