URL Encoding and Security: How Improper Encoding Can Create Vulnerabilities

A few years ago, I was reviewing a client's WAF rules and found something strange. Their filter blocked any request containing ../. Simple enough, right? Except an attacker had gotten past it using ..