Passing URL-encoded slash characters (%2F) allows accessing other users' repositories

[fd0]

@wojas discovered that it is possible to access other users' repositories (when --private-repos is used) by specifying an URL-encoded slash (/) character (as %2F) and a relative path component. So user foo was able to access the repository of user bar by accessing http://localhost:8000/foo%2F..%2Fbar. This is resolved in v0.10.0.

It is caused by very odd path handling by the goji framework used here. The code prevented accessing any files outside the repository path (--path) though.

I'd like to drop the framework and only use stdlib logic to do path handling, @wojas already started a PR #112.

I'm closing this issue since it is resolved, it was a placeholder issue so we have something to address in the changelog.