Comment 1:

Correction: by any directory I meant any subdirectory in http.FileHandler.
Until this is fixed (the best place is in path.Clean probably?) a possible workaround
for those who need it might be something like this:
func hardened(handler http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        index := strings.Index(r.URL.Path, "\x00")
        if index >= 0 {
            http.Error(w, "403 Forbidden", 403)
        } else {
            handler.ServeHTTP(w, r)
        }
    })
}
// ...
http.ListenAndServe(":80", hardened(http.DefaultServeMux))

Comment 2:

Labels changed: removed priority-triage.

Owner changed to @bradfitz.

Status changed to Accepted.

Comment 3:

http://golang.org/cl/6442061

Comment 4:

This issue was closed by revision 538b212.

Status changed to Fixed.

Comment 5:

Labels changed: added go1.0.3, security.