v0.25.0

src/acl.rs

@@ -199,6 +199,16 @@ mod tests {
             routing_path("/static/js//events.js").unwrap(),
             "/static/js/events.js"
         );
+        for path in [
+            "/%2e%2e/secret",
+            "/a/%2E%2E/b",
+            "/a%2fb",
+            "/a%5cb",
+            "/bad%",
+            "/bad%2",
+        ] {
+            assert!(routing_path(path).is_err(), "{path}");
+        }
         assert_eq!(routing_path("//admin///users").unwrap(), "/admin/users");
     }
     #[test]