Potential fix for code scanning alert no. 36: Bad redirect check
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Yechan Kim committed
Mar 26, 2026 at 00:44 UTC
3ddcdd033080cda6e056667181bc6e7a6dc0d750
1 file changed
+4
utils/utils.go
+4
@@ -185,6 +185,10 @@ func NormalizeURLPath(raw string) string {
185
if !strings.HasPrefix(clean, "/") {
186
clean = "/" + clean
187
}
188
+ // Prevent scheme-relative or otherwise ambiguous paths like "//example" or "/\example".
189
+ if len(clean) > 1 && (clean[1] == '/' || clean[1] == '\\') {
190
+ clean = "/"
191
+ }
192
if clean != "/" {
193
clean = strings.TrimSuffix(clean, "/")
194
}