Handle null byte when serving static files

lib/sinatra/base.rb

@@ -1057,13 +1057,15 @@ def route_missing
     # Attempt to serve static files from public directory. Throws :halt when
     # a matching file is found, returns nil otherwise.
     def static!(options = {})
-      return if (public_dir = settings.public_folder).nil?
-      path = File.expand_path("#{public_dir}#{URI_INSTANCE.unescape(request.path_info)}" )
-      return unless File.file?(path)
+      public_dir = settings.public_folder
+      path = "#{public_dir}#{URI_INSTANCE.unescape(request.path_info)}"
+      return if public_dir.nil? || !valid_path?(path)
+      expanded_path = File.expand_path(path)
+      return unless File.file?(expanded_path)
 
-      env['sinatra.static_file'] = path
+      env['sinatra.static_file'] = expanded_path
       cache_control(*settings.static_cache_control) if settings.static_cache_control?
-      send_file path, options.merge(:disposition => nil)
+      send_file expanded_path, options.merge(:disposition => nil)
     end
 
     # Run the block with 'throw :halt' support and apply result to the response.

test/static_test.rb

@@ -59,6 +59,12 @@ class StaticTest < Minitest::Test
     assert not_found?
   end
 
+  it 'passes to the next handler when the path contains null bytes' do
+    @app.set :public_folder, "\0"
+    get "/"
+    assert not_found?
+  end
+
   it 'passes to the next handler when the static option is disabled' do
     @app.set :static, false
     get "/#{File.basename(__FILE__)}"