Lunny Xiao 3db3c058b3 Prevent redirect bypasses via backslash-encoded paths (#36660) ...

This change tightens relative URL validation to reject raw backslashes
and `%5c` (encoded backslash), since browsers and URL normalizers can
treat backslashes as path separators. That normalization can turn
seemingly relative paths into scheme-relative URLs, creating
open-redirect risk.

Visiting below URL to reproduce the problem.

http://localhost:3000/user/login?redirect_to=/a/../\example.com

http://localhost:3000/user/login?redirect_to=/a/../%5cexample.com

---------

Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

2026-02-22 22:15:03 +00:00

..

request.go

Fix missing Close when error occurs and abused connection pool (#35658)

2025-10-15 09:47:12 +00:00

serve_test.go

Enable addtional linters (#34085)

2025-04-01 10:14:01 +00:00

serve.go

Fix bug when viewing the commit diff page with non-ANSI files (#36149)

2025-12-13 21:54:03 +08:00

url_test.go

Prevent redirect bypasses via backslash-encoded paths (#36660)

2026-02-22 22:15:03 +00:00

url.go

Prevent redirect bypasses via backslash-encoded paths (#36660)

2026-02-22 22:15:03 +00:00