A parent directory of the root can be accessed

[hayatoito]

It looks that RequestedPath::new() uses the result of decode_percents(...) without any filtering.
That allows a potential access to a parent directory of the Static's root.

For example, the following request might return the contents of /etc/passwd file.

http://host:port/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd

I guess this behavior is unintentional because this could be an security vulnerability.

[Hoverbear]

Hm, I would feel that this is a security risk yes. I would assume desirable behavior would be that you couldn't traverse "up" past the defined root.

Would you like to make a patch for this?

[hayatoito]

Sure. Let me try.

[Hoverbear]

You're the best. :)

[untitaker]

Released 0.3.1. Thanks @hayatoito!

[hayatoito]

My pleasure. Thank you for merging!