Bryan Frimin 59f8e943fb Fix open redirect bypass in saferedirect ...

Relative redirect URLs are now normalized before validation. Paths
containing backslashes (including percent-encoded %5c) are rejected,
closing a bypass where /../\evil.com passed checks but http.Redirect
normalized to /\evil.com.

Reported by Fushuling and RacerZ.

Signed-off-by: Bryan Frimin <bryan@probo.com>

2026-05-26 11:41:33 -07:00

..

saferedirect_test.go

Fix open redirect bypass in saferedirect

2026-05-26 11:41:33 -07:00

saferedirect.go

Fix open redirect bypass in saferedirect

2026-05-26 11:41:33 -07:00