Strengthen check for absolute redirect

[mccutchen]

We got a security alert regarding this line of code in the doRedirect() helper function:

go-httpbin/httpbin/handlers.go

Line 960 in 8f905de

if strings.HasPrefix(path, "/") {

Redirect URLs should be checked to ensure that user input cannot cause a site to redirect to arbitrary domains. This is often done with a check that the redirect URL begins with a slash, which most of the time is an absolute redirect on the same host. However, browsers interpret URLs beginning with // or /\ as absolute URLs. For example, a redirect to //example.com will redirect to https://example.com. Thus, redirect checks must also check the second character of redirect URLs.

[sarathsp06]

@mccutchen unable to access the link above

[mccutchen]

@sarathsp06 ah, my bad, I guess it makes some sense that the code scanning alerts would be private. I've copied the relevant context to the issue itself.