Resolves remaining Copilot review concern: paths starting with a bare
backslash (e.g. \evil.com) were not caught by the previous guard and
would be converted to /\evil.com by the 'missing root' logic, still
enabling an open-redirect attack.
Replace the two-part guard (loop for '//' + single-replace for '/\')
with a unified loop that strips any leading run of '/' and '\' down to
exactly one '/', covering:
- //example.com → /example.com
- /\example.com → /example.com
- \example.com → /example.com
- \\example.com → /example.com
Add corresponding test cases.
* perf: replace regex with custom functions in redirectTrailingSlash
* perf: use more efficient removeRepeatedChar for path slash handling
---------
Co-authored-by: 1911860538 <alxps1911@gmail.com>
* path: use stack buffer in CleanPath to avoid allocs in common case
Sync from 8222db13db
* path: sync test code from httprouter
* path: update path_test.go to the latest code
Co-authored-by: Bo-Yi Wu <appleboy.tw@gmail.com>
