blackteay/gin
3
0
Fork 0
mirror of https://github.com/gin-gonic/gin.git synced 2026-09-04 14:49:27 +08:00
Code Issues Projects Releases Wiki Activity

fix: [security] Bad redirect check

Browse Source 
* fix: [security] Bad redirect check
This commit is contained in:
Mohamad Nimer 2026-07-03 03:08:58 +03:00
parent dcaa4296d1
commit 3015d947ac
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
path.go
View File

@ -25,6 +25,13 @@ func cleanPath(p string) string {
if p == "" {
return "/"
}
// Prevent scheme-relative ("//...") or backslash-based absolute ("/\\...") paths.
for len(p) > 1 && p[0] == '/' && p[1] == '/' {
p = p[1:]
}
if len(p) > 1 && p[0] == '/' && p[1] == '\\' {
p = "/" + p[2:]
}
// Reasonably sized buffer on stack to avoid allocations in the common case.
// If a larger buffer is required, it gets allocated dynamically.