Language: Java
Label: vulnerable
CWE: NVD-CWE-noinfo \u2014 

Code:
    private static RequestTarget slowForServer(String reqTarget, boolean allowDoubleDotsInQueryString) {
        final Bytes path;
        final Bytes query;

        // Split by the first '?'.
        final int queryPos = reqTarget.indexOf('?');
        if (queryPos >= 0) {
            if ((path = decodePercentsAndEncodeToUtf8(
                    reqTarget, 0, queryPos,
                    ComponentType.SERVER_PATH, null)) == null) {
                return null;
            }
            if ((query = decodePercentsAndEncodeToUtf8(
                    reqTarget, queryPos + 1, reqTarget.length(),
                    ComponentType.QUERY, EMPTY_BYTES)) == null) {
                return null;
            }
        } else {
            if ((path = decodePercentsAndEncodeToUtf8(
                    reqTarget, 0, reqTarget.length(),
                    ComponentType.SERVER_PATH, null)) == null) {
                return null;
            }
            query = null;
        }

        // Reject a relative path and accept an asterisk (e.g. OPTIONS * HTTP/1.1).
        if (isRelativePath(path)) {
            if (query == null && path.length == 1 && path.data[0] == '*') {
                return INSTANCE_ASTERISK;
            } else {
                // Do not accept a relative path.
                return null;
            }
        }

        // Reject the prohibited patterns.
        if (pathContainsDoubleDots(path)) {
            return null;
        }
        if (!allowDoubleDotsInQueryString && queryContainsDoubleDots(query)) {
            return null;
        }

        return new DefaultRequestTarget(RequestTargetForm.ORIGIN,
                                        null,
                                        null,
                                        encodePathToPercents(path),
                                        encodeQueryToPercents(query),
                                        null);
    }