url escape before sanitizing

Signed-off-by: Parker Moore <parkrmoore@gmail.com>

lib/jekyll/url.rb

@@ -50,8 +50,12 @@ module Jekyll
 
     # Returns a sanitized String URL
     def sanitize_url(in_url)
+
+      # prevent escaped periods from bypassing sanitization
+      url = URI.unescape(in_url)
+
       # Remove all double slashes
-      url = in_url.gsub(/\/\//, "/")
+      url = url.gsub(/\/\//, "/")
 
       # Remove every URL segment that consists solely of dots
       url = url.split('/').reject{ |part| part =~ /^\.+$/ }.join('/')
@@ -61,7 +65,8 @@ module Jekyll
 
       # Always add a leading slash
       url.gsub!(/\A([^\/])/, '/\1')
-      url
+
+      URI.escape url
     end
   end
 end

test/test_post.rb

@@ -109,7 +109,7 @@ class TestPost < Test::Unit::TestCase
         post.write(dest_dir)
 
         assert !File.exist?(File.expand_path("../baddie.html", dest_dir))
-        assert File.exist(File.expand_path("/baddie.html", dest_dir))
+        assert File.exist?(File.expand_path("baddie.html", dest_dir))
       end
 
       context "with CRLF linebreaks" do