metsw24-max 276cf08e84 Refuse a proxied path that does not start with a slash (#2638) ...

In absolute-form the path follows the authority, so a path such as "@evil.example/x" made the proxy connect to another host and forward the origin's credentials. Both handle_request and open_stream_ now refuse such a path before anything is written.

2026-10-22 17:01:58 -04:00

1.0 MiB

Raw Blame History

View Raw