  @Test public void pathParametersAndPathTraversal() {
    class Example {
      @GET("/foo/bar/{ping}/") //
      Call<ResponseBody> method(@Path(value = "ping") String ping) {
        return null;
      }
    }

    assertMalformedRequest(Example.class, ".");
    assertMalformedRequest(Example.class, "..");

    assertThat(buildRequest(Example.class, "./a").url().encodedPath())
        .isEqualTo("/foo/bar/.%2Fa/");
    assertThat(buildRequest(Example.class, "a/.").url().encodedPath())
        .isEqualTo("/foo/bar/a%2F./");
    assertThat(buildRequest(Example.class, "a/..").url().encodedPath())
        .isEqualTo("/foo/bar/a%2F../");
    assertThat(buildRequest(Example.class, "../a").url().encodedPath())
        .isEqualTo("/foo/bar/..%2Fa/");
    assertThat(buildRequest(Example.class, "..\\..").url().encodedPath())
        .isEqualTo("/foo/bar/..%5C../");

    assertThat(buildRequest(Example.class, "%2E").url().encodedPath())
        .isEqualTo("/foo/bar/%252E/");
    assertThat(buildRequest(Example.class, "%2E%2E").url().encodedPath())
        .isEqualTo("/foo/bar/%252E%252E/");
  }
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.