On Thu, 28 Jun 2012, Tatsuhiro Tsujikawa wrote:

> I changed libmetalink code not to allow '.' in the first character in path
> or filename following the last slash.

What about "../" occurances? Like a file name called "/home/../../etc/passwd"
...

-- 
  / daniel.haxx.se
-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-users
FAQ:        http://curl.haxx.se/docs/faq.html
Etiquette:  http://curl.haxx.se/mail/etiquette.html