From 3015d947accfa7dec8bdafee33e642978f59af1d Mon Sep 17 00:00:00 2001
From: Mohamad Nimer <m7ammad.nimer@gmail.com>
Date: Fri, 3 Jul 2026 03:08:58 +0300
Subject: [PATCH] fix: [security] Bad redirect check

* fix: [security] Bad redirect check
---
 path.go | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/path.go b/path.go
index 672213d1..c079cb41 100644
--- a/path.go
+++ b/path.go
@@ -25,6 +25,13 @@ func cleanPath(p string) string {
 	if p == "" {
 		return "/"
 	}
+	// Prevent scheme-relative ("//...") or backslash-based absolute ("/\\...") paths.
+	for len(p) > 1 && p[0] == '/' && p[1] == '/' {
+		p = p[1:]
+	}
+	if len(p) > 1 && p[0] == '/' && p[1] == '\\' {
+		p = "/" + p[2:]
+	}
 
 	// Reasonably sized buffer on stack to avoid allocations in the common case.
 	// If a larger buffer is required, it gets allocated dynamically.