File writing by Directory traversal at actionpack-page_caching and RCE by it

I found a directory traversal in `actionpack-page_caching`. Some code may lead to RCE.

  def cache_file(path, extension)
    if path.empty? || path =~ %r{\A/+\z}
      name = "/index"
    else
      name = URI.parser.unescape(path.chomp("/"))
    end

    if File.extname(name).empty?
      name + (extension || default_extension)
    else
      name
    end
  end

  def …