<p dir="auto">When a site redirects to an URL containing "/../", requests passes it verbatim instead of interpreting it.</p>
<h2 dir="auto">Expected Result</h2>
<p dir="auto">requests should remove the ".." component and the previous component, by interpreting the ".." as meaning "parent folder".<br>
All real browsers do it. libcurl/curl (and wget) does it too.<br>
Test for example <a href="https://httpbin.org/redirect-to?url=https%3A%2F%2Fhttpbin.org%2Ffoo%2F%2E%2E%2Fget" rel="nofollow">https://httpbin.org/redirect-to?url=https%3A%2F%2Fhttpbin.org%2Ffoo%2F%2E%2E%2Fget</a></p>
<h2 dir="auto">Actual Result</h2>
<p dir="auto">requests fails to interpret it like other HTTP clients do and passes the "/../" verbatim, leading to errors on servers, ranging from 500 errors to 404 errors (as for httpbin).</p>
<h2 dir="auto">Reproduction Steps</h2>
<div class="highlight highlight-source-python notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="import requests
r = requests.get('https://httpbin.org/redirect-to?url=https%3A%2F%2Fhttpbin.org%2Ffoo%2F%2E%2E%2Fget')
print(r.status_code, r.url)"><pre class="notranslate"><span class="pl-k">import</span> <span class="pl-s1">requests</span>
<span class="pl-s1">r</span> <span class="pl-c1">=</span> <span class="pl-s1">requests</span>.<span class="pl-en">get</span>(<span class="pl-s">'https://httpbin.org/redirect-to?url=https%3A%2F%2Fhttpbin.org%2Ffoo%2F%2E%2E%2Fget'</span>)
<span class="pl-en">print</span>(<span class="pl-s1">r</span>.<span class="pl-s1">status_code</span>, <span class="pl-s1">r</span>.<span class="pl-s1">url</span>)</pre></div>
<h2 dir="auto">System Information</h2>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="$ python -m requests.help"><pre class="notranslate"><code class="notranslate">$ python -m requests.help
</code></pre></div>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="{
  &quot;chardet&quot;: {
    &quot;version&quot;: &quot;3.0.4&quot;
  }, 
  &quot;cryptography&quot;: {
    &quot;version&quot;: &quot;&quot;
  }, 
  &quot;idna&quot;: {
    &quot;version&quot;: &quot;2.6&quot;
  }, 
  &quot;implementation&quot;: {
    &quot;name&quot;: &quot;CPython&quot;, 
    &quot;version&quot;: &quot;2.7.15&quot;
  }, 
  &quot;platform&quot;: {
    &quot;release&quot;: &quot;4.15.0-1-amd64&quot;, 
    &quot;system&quot;: &quot;Linux&quot;
  }, 
  &quot;pyOpenSSL&quot;: {
    &quot;openssl_version&quot;: &quot;&quot;, 
    &quot;version&quot;: null
  }, 
  &quot;requests&quot;: {
    &quot;version&quot;: &quot;2.18.4&quot;
  }, 
  &quot;system_ssl&quot;: {
    &quot;version&quot;: &quot;1010008f&quot;
  }, 
  &quot;urllib3&quot;: {
    &quot;version&quot;: &quot;1.22&quot;
  }, 
  &quot;using_pyopenssl&quot;: false
}"><pre class="notranslate"><code class="notranslate">{
  "chardet": {
    "version": "3.0.4"
  }, 
  "cryptography": {
    "version": ""
  }, 
  "idna": {
    "version": "2.6"
  }, 
  "implementation": {
    "name": "CPython", 
    "version": "2.7.15"
  }, 
  "platform": {
    "release": "4.15.0-1-amd64", 
    "system": "Linux"
  }, 
  "pyOpenSSL": {
    "openssl_version": "", 
    "version": null
  }, 
  "requests": {
    "version": "2.18.4"
  }, 
  "system_ssl": {
    "version": "1010008f"
  }, 
  "urllib3": {
    "version": "1.22"
  }, 
  "using_pyopenssl": false
}
</code></pre></div>
<p dir="auto">Browser &amp; other tools seem to ignore trailing dot in the URL. Unfortunately <code class="notranslate">requests</code> does not.</p>
<p dir="auto">Compare</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="$ curl -s https://github.com/. -o /dev/null -w &quot;%{http_code}&quot;; echo
200"><pre class="notranslate"><code class="notranslate">$ curl -s https://github.com/. -o /dev/null -w "%{http_code}"; echo
200
</code></pre></div>
<p dir="auto">With</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="$ python -c 'import requests; print(requests.get(&quot;https://github.com/.&quot;).status_code)'
404"><pre class="notranslate"><code class="notranslate">$ python -c 'import requests; print(requests.get("https://github.com/.").status_code)'
404
</code></pre></div>