Handle null byte when serving requests for paths with null bytes.

lib/sinatra/base.rb

@@ -1057,13 +1057,16 @@ def route_missing
     # Attempt to serve static files from public directory. Throws :halt when
     # a matching file is found, returns nil otherwise.
     def static!(options = {})
-      return if (public_dir = settings.public_folder).nil?
-      path = File.expand_path("#{public_dir}#{URI_INSTANCE.unescape(request.path_info)}" )
-      return unless File.file?(path)
-
-      env['sinatra.static_file'] = path
+      public_dir = settings.public_folder
+      return if public_dir.nil?
+      path = "#{public_dir}#{URI_INSTANCE.unescape(request.path_info)}"
+      return unless valid_path?(path)
+      expanded_path = File.expand_path(path)
+      return unless File.file?(expanded_path)
+
+      env['sinatra.static_file'] = expanded_path
       cache_control(*settings.static_cache_control) if settings.static_cache_control?
-      send_file path, options.merge(:disposition => nil)
+      send_file expanded_path, options.merge(:disposition => nil)
     end
 
     # Run the block with 'throw :halt' support and apply result to the response.

test/static_test.rb

@@ -55,6 +55,11 @@ class StaticTest < Minitest::Test
   end
 
   it 'does not serve directories' do
+    get "/foo%00"
+    assert not_found?
+  end
+
+  it 'passes to the next handler when the path contains null bytes' do
     get "/"
     assert not_found?
   end