hhvm/hack-example-site — pull request #7 by SobanVuex (2014-04-17 21:07:16+00:00)
Title: Safer fastcgi config - fixes #6

In PHP there is a functionality to "fix" pathinfo. In fastcgi it can be disabled via `cgi.fix_pathinfo = 0;`
If same/similar applies to hhvm then without try_files a potential attacker can access
`/hostile.file/fake.php` which would in turn process `hostile.file` with pathinfo of `fake.php`