cherrypy.url fails to normalize path

[lbolla]

This call to cherrypy.url fails with IndexError:

>>> cherrypy.url(qs='../../../../../../etc/passwd')
...
IndexError: pop from empty list

The culprit seems in this logic, which strips newurl of as many atoms as there are ..:
https://github.com/cherrypy/cherrypy/blob/master/cherrypy/_helper.py#L261,L271

There are various problems.

• That logic should only applied to the "path" part of newurl, not to the full url.

• As a consequence of the point above, .. in the query string qs should not be considered

• To consider: redundant .. should be ignored, to mimic os.path.normpath:

>>> os.path.normpath('/etc/../../../usr')
'/usr'