redirect

func PathIsPlain ¶

func PathIsPlain(u *url.URL) bool

PathIsPlain reports whether u's path is the path a browser will request: it has no "." or ".." segments, written plainly or percent-encoded, and does not decode to one starting with "//".

A validator that checks the raw string and then hands it on is not enough on its own: "/.//evil.example" starts with a single slash, but a client that resolves it and rebuilds the URL from its path gets "//evil.example", which a browser reads as another host.