Saxon

This method should only be used when comparing two URIs to see if they are "the same". As far as I can see the workings of the method are consistent with that intended usage. Are you perhaps using the method to achieve something different?

I think that the problem is the creation of the File from the URL. If the URL contains %20, this should be escaped when the file is created. We found a problem when the SecurityManager is set and the file permissions are verified. Here is a test case:

public void testCanonicalization() throws Exception {
    File file = new File("././ceva/../file with spaces.xml");
    String fileUrl = URLUtil.correct(file).toExternalForm();
    
    System.setSecurityManager(new SecurityManager() {
      @Override
      public void checkPermission(Permission perm) {
        if (perm instanceof FilePermission) {
          assertFalse(perm.getName(), perm.getName().contains("%20"));
        }
      }
      @Override
      public void checkPermission(Permission perm, Object context) {
        this.checkPermission(perm);
      }
    });
    String normalizedUri;
    try {
      normalizedUri = DocumentKey.normalizeURI(fileUrl);
    } finally {
      System.setSecurityManager(null);
    }
    assertTrue(normalizedUri, normalizedUri.endsWith("/file%20with%20spaces.xml"));
    assertFalse(normalizedUri, normalizedUri.contains(".."));
    assertFalse(normalizedUri, normalizedUri.contains("./"));
  }