No restriction on AssetPipelineLoader and FileSystemLoader paths #217
Description
Currently there are directory traversal issues in the AssetPipelineLoader and FileSystemLoader. Premailer-rails will attempt to inline CSS from any local file. This will only inline portions that are close enough to CSS to be returned, but these strategies likely don't need to load files outside of predetermined paths.
Ex.
<link rel="stylesheet" type="text/css" href="/assets/../../../../../../../../../../etc/passwd">
It seems that the AssetPipelineLoader could be restricted to valid asset paths for the application, and the FileSystemLoader could be restricted to paths under /public.