---
id: review-002-fwd13-dot-segments
name: Reject lone dot-dot path values that Url-set_path normalizes away (FWD-13)
status: pending
depends_on: []
scope: narrow
risk: medium
impact: component
level: implementation
tags: [adapters, review-002, security, from-openapi]
---

## Description

Review 002 FWD-13 [major, security]. Lone `.`/`..` path-parameter
values survive the PATH_VALUE_ENCODE_SET (which has no `.`) and are
**silently normalized away by `Url::set_path`** — empirically
reproduced against the locked `url 2.5.8`:

- `set_path("/tenants/../admin")` → `/admin`
- `set_path("/files/..")` → `/`
- `set_path("/repos/%2e%2e/x")` → `/x` (so adding `%2e` to the encode
  set would NOT fix it — the parser normalizes every case-insensitive
  spelling)

Scenario: template `/tenants/{tenant}/resources` with peer input
`tenant = ".."` → the upstream receives `/resources` — a *different*
(east commonly less-scoped, list-everything) endpoint than the template
describes, **with the namespace's injected credentials attached**. The
existing dot-segment test (`traversal_value_cannot_escape_template_path`,
forward.rs:1155) only covers the multi-segment `../../admin` form the
encoder *does* catch. The origin check in `assemble_request_url`
(:520-522) cannot catch this — the origin never changes.

## Acceptance Criteria

- [ ] Rendered path **values** that are exactly `.` or `..`
      (case-insensitive, including `%2e` spellings before encoding) are
      rejected with a loud `INVALID_INPUT`-family CallError — the
      cleanest point is `value_to_path_segment` / `render_path_template`
- [ ] A post-`set_path` invariant assert (decoded path segments =
      base_dir + rendered segments, byte-identical) protects against
      future normalizer surprises (implementer's choice: debug_assert
      + loud runtime check, or a property test with a dot/percent/binary
      corpus)
- [ ] Tests: lone `..` value → error; lone `.` value → error; `%2e%2e`
      spelling → error; a *legitimate* segment containing a dot
      (`v1.2.3`, `.hidden-file` as a value) still works (the rejection
      is exact-match, not substring)
- [ ] Existing traversal/encoding tests unchanged and passing
- [ ] `cargo test`, `cargo clippy --all-targets -- -D warnings`,
      `cargo fmt --check` pass

## References

- docs/reviews/002-post-remediation-review.md (Part D', FWD-13)
- src/adapters/forward.rs:340-352 (encode set lacking `.`), :413-448 (renderer), :481-531 (set_path + origin check), :1155 (the test family)
- tasks/adapters/review-001-forward-url-safety.md (the FWD-01 fix this completes — one case short)

## Notes

The error message must not echo the raw value's neighbor inputs (no
spec/content leakage beyond the parameter name — follow the existing
message style in `render_path_template`'s unbound-placeholder error).
FWD-18 (object/array placeholder values double-routing to query) is
tracked separately in review-002-fwd17-19-contract-decisions — do not
fold it here, the mechanisms are adjacent but the decisions differ.