net/url: preserve leading slashes when resolving path

When doing resolvePath, if there are multiple leading slashes in the target, preserve them. This prevents an issue where the Go http.Client cleans up multiple leading slashes in the Location header in a redirect, resulting in a redirection to the incorrect target. Fixes #21158. Change-Id: I6a21ea61ca3bc7033f3c8a6ccc21ecaa3e996fa8 Reviewed-on: https://go-review.googlesource.com/51050 Reviewed-by: Russ Cox <rsc@golang.org> Run-TryBot: Russ Cox <rsc@golang.org>
golang · Oct 30, 2017 · 84e91e1 · 84e91e1
1 parent b4c3fe7
commit 84e91e1
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/src/net/url/url.go b/src/net/url/url.go
@@ -911,7 +911,7 @@ func resolvePath(base, ref string) string {
 		// Add final slash to the joined path.
 		dst = append(dst, "")
 	}
-	return "/" + strings.TrimLeft(strings.Join(dst, "/"), "/")
+	return "/" + strings.TrimPrefix(strings.Join(dst, "/"), "/")
 }
 
 // IsAbs reports whether the URL is absolute.

diff --git a/src/net/url/url_test.go b/src/net/url/url_test.go
@@ -1032,6 +1032,10 @@ var resolveReferenceTests = []struct {
 	{"http://foo.com/bar?a=b", "/baz?", "http://foo.com/baz?"},
 	{"http://foo.com/bar?a=b", "/baz?c=d", "http://foo.com/baz?c=d"},
 
+	// Multiple slashes
+	{"http://foo.com/bar", "http://foo.com//baz", "http://foo.com//baz"},
+	{"http://foo.com/bar", "http://foo.com///baz/quux", "http://foo.com///baz/quux"},
+
 	// Scheme-relative
 	{"https://foo.com/bar?a=b", "//bar.com/quux", "https://bar.com/quux"},