in src/main/java/org/apache/sling/engine/impl/request/RequestData.java [739:763]
private static boolean traversesParentPath(String path) {
int index = 0;
while (index < path.length()) {
int charCount = 0;
int dotCount = 0;
// count dots (".") and total chars in each path segment (between two '/')
while (index < path.length() && path.charAt(index) != '/') {
char c = path.charAt(index);
if (!SKIPPED_TRAVERSAL_CHARS.contains(c)) {
if (c == '.') {
dotCount++;
}
charCount++;
}
index++;
}
// if all chars are dots (".")
// path is traversing the parent directory
if (charCount > 1 && dotCount == charCount) {
return true;
}
index++;
}
return false;
}