    void shouldNotDecodeSlash() {
        final PathAndQuery res = PathAndQuery.parse("%2F?%2F");
        // Do not accept a relative path.
        assertThat(res).isNull();
        final PathAndQuery res1 = PathAndQuery.parse("/%2F?%2F");
        assertThat(res1).isNotNull();
        assertThat(res1.path()).isEqualTo("/%2F");
        assertThat(res1.query()).isEqualTo("%2F");

        final PathAndQuery pathOnly = PathAndQuery.parse("/foo%2F");
        assertThat(pathOnly).isNotNull();
        assertThat(pathOnly.path()).isEqualTo("/foo%2F");
        assertThat(pathOnly.query()).isNull();

        final PathAndQuery queryOnly = PathAndQuery.parse("/?%2f=%2F");
        assertThat(queryOnly).isNotNull();
        assertThat(queryOnly.path()).isEqualTo("/");
        assertThat(queryOnly.query()).isEqualTo("%2F=%2F");
    }
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.