directory() middleware does not escape #

[ghost]

It's impossible to enter directories or open files whose name starts with a #

[jonathanong]

are you trying to access this from the browser? the browser doesn't even send the hash portion of the URL, so you'll have it escape it yourself.

[dougwilson]

I believe he means that if there is a directory on the server named #blah the URL to open that directory when looking at the parent directory includes a literal #, and so the client doesn't send the # and everything after it.

<a href="/dir/#child>#child</a>

The browser will just request /dir/ because of this.