Bug 59688

Summary: Path normalization: dot segments with extra slashes resolves to unexpected path
Product: Apache httpd-2 Reporter: David Eckel <dvdckl>
Component: CoreAssignee: Apache HTTPD Bugs Mailing List <bugs>
Status: NEW ---    
Severity: trivial    
Priority: P2    
Version: 2.4.20   
Target Milestone: ---   
Hardware: PC   
OS: All   

Description David Eckel 2016-06-09 23:20:13 UTC 
Apache httpd resolves paths with extra slashes and dot segments differently than other HTTP servers and clients. It looks like it's collapsing redundant slashes *after* it resolves relative path segments instead of before.

Program               Input       Resolved to
--------------------- ----------  -----------
Apache httpd          /foo///../  /foo/
NGINX                 /foo///../  /
Tomcat getServletPath /foo///../  /
Node Path.normalize   /foo///../  /
Windows filesystem    /foo///../  /
Linux filesystem      /foo///../  /
Akamai                /foo///../  /foo/../
Chrome                /foo///../  /foo//
Firefox               /foo///../  /foo//
Edge                  /foo///../  /foo//

RFC 3986 doesn't specifically address duplicate slashes, so I'm unclear on what the correct behavior is.
https://bz.apache.org/bugzilla/show_bug.cgi?id=49396 is somewhat be related.