Bug 59688 - Path normalization: dot segments with extra slashes resolves to unexpected path
Summary: Path normalization: dot segments with extra slashes resolves to unexpected path
Status: NEW
Alias: None
Product: Apache httpd-2
Classification: Unclassified
Component: Core (show other bugs)
Version: 2.4.20
Hardware: PC All
: P2 trivial (vote)
Target Milestone: ---
Assignee: Apache HTTPD Bugs Mailing List
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-06-09 23:20 UTC by David Eckel
Modified: 2016-06-09 23:20 UTC (History)
0 users



Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description David Eckel 2016-06-09 23:20:13 UTC
Apache httpd resolves paths with extra slashes and dot segments differently than other HTTP servers and clients. It looks like it's collapsing redundant slashes *after* it resolves relative path segments instead of before.

Program               Input       Resolved to
--------------------- ----------  -----------
Apache httpd          /foo///../  /foo/
NGINX                 /foo///../  /
Tomcat getServletPath /foo///../  /
Node Path.normalize   /foo///../  /
Windows filesystem    /foo///../  /
Linux filesystem      /foo///../  /
Akamai                /foo///../  /foo/../
Chrome                /foo///../  /foo//
Firefox               /foo///../  /foo//
Edge                  /foo///../  /foo//

RFC 3986 doesn't specifically address duplicate slashes, so I'm unclear on what the correct behavior is.
https://bz.apache.org/bugzilla/show_bug.cgi?id=49396 is somewhat be related.