Giteabot 2aee44cdd9

Prevent redirect bypasses via backslash-encoded paths (#36660) (#36716) ...

Backport #36660 by @lunny

This change tightens relative URL validation to reject raw backslashes
and `%5c` (encoded backslash), since browsers and URL normalizers can
treat backslashes as path separators. That normalization can turn
seemingly relative paths into scheme-relative URLs, creating
open-redirect risk.

Visiting below URL to reproduce the problem.

http://localhost:3000/user/login?redirect_to=/a/../\example.com

http://localhost:3000/user/login?redirect_to=/a/../%5cexample.com

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

2026-02-23 01:59:59 +01:00

..

request.go

Fix missing Close when error occurs and abused connection pool (#35658) (#35670)

2025-10-15 09:56:53 +00:00

serve_test.go

Enable addtional linters (#34085)

2025-04-01 10:14:01 +00:00

serve.go

Fix external render, make iframe render work (#35727, #35730) (#35731)

2025-10-23 16:07:17 +08:00

url_test.go

Prevent redirect bypasses via backslash-encoded paths (#36660) (#36716)

2026-02-23 01:59:59 +01:00

url.go

Prevent redirect bypasses via backslash-encoded paths (#36660) (#36716)

2026-02-23 01:59:59 +01:00