Bypassing Path-Traversal Filters: Encoding, Double-Encoding and Null Bytes
A filter that decodes input and then blocks ../ is defeated by the first encoding it didn't anticipate. Here is how percent-encoding, double-encoding, overlong UTF-8, backslashes, nested sequences and null bytes walk straight past a blocklist, and why canonicalize-then-verify is the only fix that holds.