Check incoming Uri-Path and Location-Path options for just . or .. (or %2e hex encoded variants) and treat as being invalid. Stop insertion of Uri-Path and Location-Path options that contain just . or .. (or %2e hex encoded variants).