Fix redirect

modules/httplib/url.go

@@ -24,6 +24,10 @@ func urlIsRelative(s string, u *url.URL) bool {
 	if len(s) > 1 && (s[0] == '/' || s[0] == '\\') && (s[1] == '/' || s[1] == '\\') {
 		return false
 	}
+	// Backslashes (including encoded) can be normalized by browsers into slashes and allow open redirects.
+	if strings.Contains(s, "\\") || strings.Contains(strings.ToLower(s), "%5c") {
+		return false
+	}
 	return u != nil && u.Scheme == "" && u.Host == ""
 }
 

modules/httplib/url_test.go

@@ -32,6 +32,9 @@ func TestIsRelativeURL(t *testing.T) {
 		"\\\\",
 		"/\\",
 		"\\/",
+		"/a/../\\example.com",
+		"/%5cexample.com",
+		"/a/../%5cexample.com",
 		"mailto:a@b.com",
 		"https://test.com",
 	}