The vulnerability (CVE-2008-2370) stems from Tomcat's RequestDispatcher performing path normalization before removing the query string. This allowed attackers to inject '..' sequences via request parameters to bypass security constraints. The functions responsible for URI parsing and normalization in the ApplicationDispatcher class are directly implicated, as the fix involved reordering these operations (strip query first, then normalize). Commit diffs and Apache's security advisories confirm the affected logic resided in these components.