Nick Craig-Wood 28562c8a79 rest: add URLJoinRoot to join a path onto a URL without changing its host GHSA-xqmq-v4wj-rw5m CVE-PENDING ...

rest.URLJoin resolves its path as a URL reference according to the URL
standard, so a path beginning with `//` is a network-path reference
which replaces the host (and port and userinfo) of the base URL. That
is often the wrong behaviour.

Add rest.URLJoinRoot which joins an unescaped root onto a base URL and
refuses any root which parses with a scheme, host or userinfo of its own.

2026-10-08 22:49:33 +01:00

..

headers_test.go

lib/rest: validate ranged responses

2026-08-14 18:40:40 +02:00

headers.go

lib/rest: make ParseContentRange public

2026-08-24 18:16:12 +01:00

rest_test.go

rest: add StripHeadersOnCrossHostRedirectFn and use it in the s3 and http backends

2026-10-08 22:38:27 +01:00

rest.go

rest: add StripHeadersOnCrossHostRedirectFn and use it in the s3 and http backends

2026-10-08 22:38:27 +01:00

url_test.go

rest: add URLJoinRoot to join a path onto a URL without changing its host GHSA-xqmq-v4wj-rw5m CVE-PENDING

2026-10-08 22:49:33 +01:00

url.go

rest: add URLJoinRoot to join a path onto a URL without changing its host GHSA-xqmq-v4wj-rw5m CVE-PENDING

2026-10-08 22:49:33 +01:00