From bb6335b24a8eba105ae73465e319d281dd593d23 Mon Sep 17 00:00:00 2001
From: "Nimer@Tornado" <m7ammad.nimer@gmail.com>
Date: Sun, 5 Jul 2026 05:41:00 +0300
Subject: [PATCH] fix: [security] Bad redirect check

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 path.go | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/path.go b/path.go
index c079cb41..9fe1f0aa 100644
--- a/path.go
+++ b/path.go
@@ -25,12 +25,9 @@ func cleanPath(p string) string {
 	if p == "" {
 		return "/"
 	}
-	// Prevent scheme-relative ("//...") or backslash-based absolute ("/\\...") paths.
-	for len(p) > 1 && p[0] == '/' && p[1] == '/' {
-		p = p[1:]
-	}
-	if len(p) > 1 && p[0] == '/' && p[1] == '\\' {
-		p = "/" + p[2:]
+	// Prevent scheme-relative or backslash-based absolute redirects.
+	if len(p) > 1 && p[0] == '/' && (p[1] == '/' || p[1] == '\\') {
+		return "/"
 	}
 
 	// Reasonably sized buffer on stack to avoid allocations in the common case.