sanity check for pages permalink traversal

Signed-off-by: Parker Moore <parkrmoore@gmail.com>

lib/jekyll/page.rb

@@ -135,7 +135,7 @@ module Jekyll
     #
     # Returns the destination file path String.
     def destination(dest)
-      path = File.join(dest, self.url)
+      path = File.join(dest, File.expand_path(self.url, "/"))
       path = File.join(path, "index.html") if self.url =~ /\/$/
       path
     end

test/source/exploit.md

@@ -0,0 +1,5 @@
+---
+permalink: /%2e%2e/%2e%2e/%2e%2e/baddie.html
+---
+
+# Test

test/test_filters.rb

@@ -131,7 +131,7 @@ class TestFilters < Test::Unit::TestCase
             assert_equal 2, g["items"].size
           when ""
             assert g["items"].is_a?(Array), "The list of grouped items for '' is not an Array."
-            assert_equal 5, g["items"].size
+            assert_equal 6, g["items"].size
           end
         end
       end

test/test_page.rb

@@ -124,6 +124,16 @@ class TestPage < Test::Unit::TestCase
         assert_equal @page.permalink, @page.url
         assert_equal "/about/", @page.dir
       end
+
+      should "not be writable outside of destination" do
+        unexpected = File.expand_path("../../../baddie.html", dest_dir)
+        File.delete unexpected if File.exist?(unexpected)
+        page = setup_page("exploit.md")
+        do_render(page)
+        page.write(dest_dir)
+
+        assert !File.exist?(unexpected)
+      end
     end
 
     context "with specified layout of nil" do

test/test_site.rb

@@ -157,7 +157,7 @@ class TestSite < Test::Unit::TestCase
     should "sort pages alphabetically" do
       stub.proxy(Dir).entries { |entries| entries.reverse }
       @site.process
-      sorted_pages = %w(.htaccess about.html bar.html contacts.html deal.with.dots.html foo.md index.html index.html properties.html sitemap.xml symlinked-file)
+      sorted_pages = %w(.htaccess about.html bar.html contacts.html deal.with.dots.html exploit.md foo.md index.html index.html properties.html sitemap.xml symlinked-file)
       assert_equal sorted_pages, @site.pages.map(&:name)
     end