The resource resolver performs path normalization using ResourceUtil.normalize().
This leads to unexpected results in the case of a combination of non-existing resources, and multiple dots in a path segment.
E.g. the following request:
will be decomposed as follows:
Extension=json resourcePath=/content/a.js/.. selectors=[, , , children, , , , -1] seclectorString=...children....-1... suffix=/a.txt
Note that the first two dots of the third path segment are interpreted as the parent path (a.js does not exist), which essentially turns this line into /content.children.-1.json/a.txt, which can confuse reverse proxies.
I think the .. should only be interpreted as the parent path if followed by a / (or potentially a semicolon if path parameters on .. segments should be allowed).
SLING-10225 Files with ".." In Name Throw 400 Exception