CVE-2020-15230: Arbitrary file read using percent-encoded relative paths in FileMiddleware

The vulnerability stemmed from the order of operations in path processing. The original implementation: 1. Took the raw URL path (still percent-encoded) 2. Trimmed leading slashes 3. Later applied percent-decoding when constructing the filesystem path. This allowed attackers to submit paths like '%2e%2e/secret' which would pass the initial 'relative path' check (appearing as non-slash-prefixed), then decode to '../secret' when accessing the filesystem. The patch fixed this by percent-decoding before path validation(), ensuring security checks see the actual path characters.