{"issue":{"state":"open","pull_request":{"diff_url":null,"html_url":null,"patch_url":null},"user":{"avatar_url":"https://secure.gravatar.com/avatar/98d0d3050a684a05c1f6f08d5bafd49e?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png","gravatar_id":"98d0d3050a684a05c1f6f08d5bafd49e","url":"https://api.github.com/users/philc","login":"philc","id":8598},"milestone":null,"assignee":null,"updated_at":"2011-11-09T03:31:05Z","labels":[],"comments":1,"closed_at":null,"url":"https://api.github.com/repos/sinatra/sinatra/issues/403","body":"When parsing the request path, Sinatra is dropping a slash if the path contains two adjacent slashes. This is a regression.\r\n\r\nIn 1.2.6 from request.env:\r\n\r\n    \"REQUEST_URI\" =>\"/v2//parent/child\", \r\n    \"REQUEST_PATH\"=>\"/v2//parent/child\"\r\n\r\nIn 1.3.0 and 1.3.1 from request.env:\r\n\r\n    \"REQUEST_URI\" =>\"/v2//parent/child\", \r\n    \"REQUEST_PATH\"=>\"/v2/parent/child\"\r\n\r\nFor reference URI.parse maintains the double slash as expected:\r\n\r\n    URI.parse(\"http://google.com/1//23\").path\r\n    => \"/1//23\"","html_url":"https://github.com/sinatra/sinatra/issues/403","title":"Parsing of paths with adjacent slashes was regressed in 1.3.0","number":403,"id":2180964,"created_at":"2011-11-08T23:31:19Z"},"action":"created","comment":{"user":{"avatar_url":"https://secure.gravatar.com/avatar/5c2b452f6eea4a6d84c105ebd971d2a4?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png","gravatar_id":"5c2b452f6eea4a6d84c105ebd971d2a4","url":"https://api.github.com/users/rkh","login":"rkh","id":30442},"updated_at":"2011-11-09T03:31:05Z","url":"https://api.github.com/repos/sinatra/sinatra/issues/comments/2677118","body":"That is not a regression, that is a feature. Use\r\n\r\n``` ruby\r\ndisable :protection\r\n```\r\n\r\nor\r\n\r\n``` ruby\r\nset :protection, :except => :path_traversal\r\n```\r\n\r\nto fix this.\r\n\r\nSinatra 1.3.0 is the first release to properly handle URLs as specified by RFC 2616 and RFC 2396. However, that parsing actually exposes a security vulnerability (path traversal attacks) from which people could suffer unknowingly. This behavior is a byproduct of the traversal prevention. It might be fixable. I would like to hear the reasoning behind your use case, so I can fine-tune the path straightening. Why does the double slash in there matter?","id":2677118,"created_at":"2011-11-09T03:31:05Z"}}