title: Sanitising a download URL with params being passed to send_file
body: <p>I have numerous files in a directory <code>app/assets/downloadables/</code> and I want authenticated users to be able to download arbitrary files by name in params within that directory or any subdirectories.</p>
  
  <p>How can I sanitise the input to <code>send_file</code> to prevent users from accessing arbitrary files on the server?</p>
  
  <p>At the moment I'm looking at doing something like this, but I'm not confident that it's safe:</p>
  
  <pre><code>DOWNLOADS_ROOT = File.join(Rails.root, "app", "assets", "downloadables")
  # e.g. request.path = "/downloads/subdir/file1.pdf"
  file = request.path.gsub(/^\/downloads\//,'').gsub('..','').split('/')
  # send file /app/assets/downloadables/subdir/file1.pdf
  send_file File.join(DOWNLOADS_ROOT, file)
  </code></pre>
  
  <p>Would this sufficiently protect against app-wide arbitrary file access or are there improvements or a different approach that would be better?</p>