VULN-141859: Normalize request path
This PR is fixing VULN-141859. Basically, this follows on [RFC-3986](https://datatracker.ietf.org/doc/html/rfc3986#section-5.2.4) clean algorithm by taking<span dir=""> a path with dot parts like </span>`./`<span dir=""> or </span>`../`<span dir=""> and cleaning them, outputting an absolute path</span> (RFC can be found [here](https://datatracker.ietf.org/doc/html/rfc3986#section-5.2.4)). The bulk of the changes are introduced in `canonicalizeRequestPath`, which does the following: (1) Rejects paths escaping root, (2) applies path.Clean, (3) preserves trailing slash, and (4) clears RawPath so that escaping matches the canonical Path. We also added tests to test the normalization logic we added.
M
Miguel da Costa Martins Marcelino committed
b4f47e2ab538ab6e31d3dc6adc5489455ad446de
Parent: e8ccca2
Committed by João "Pisco" Fernandes <joaocarlos@cloudflare.com>
on 8/12/2026, 4:57:33 PM