blackteay/gin
3
0
Fork 0
mirror of https://github.com/gin-gonic/gin.git synced 2026-09-04 22:53:34 +08:00
Code Issues Projects Releases Wiki Activity

fix: [security] Bad redirect check

Browse Source 
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
This commit is contained in:
Nimer@Tornado 2026-07-05 05:41:00 +03:00 committed by Mohamad Nimer
parent 3015d947ac
commit bb6335b24a
1 changed files with 3 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
path.go
View File

@ -25,12 +25,9 @@ func cleanPath(p string) string {
if p == "" { if p == "" {
return "/" return "/"
} }
// Prevent scheme-relative ("//...") or backslash-based absolute ("/\\...") paths. // Prevent scheme-relative or backslash-based absolute redirects.
for len(p) > 1 && p[0] == '/' && p[1] == '/' { if len(p) > 1 && p[0] == '/' && (p[1] == '/' || p[1] == '\\') {
p = p[1:] return "/"
}
if len(p) > 1 && p[0] == '/' && p[1] == '\\' {
p = "/" + p[2:]
} }
// Reasonably sized buffer on stack to avoid allocations in the common case. // Reasonably sized buffer on stack to avoid allocations in the common case.