[martinyonatann]

Summary

Hardens the Redirect middlewares (HTTPSRedirect, HTTPSWWWRedirect, HTTPSNonWWWRedirect, WWWRedirect, NonWWWRedirect) in middleware/redirect.go against open redirect (CWE-601) and malformed redirect URLs:

1. Validate req.Host before redirecting:
   • Rejects empty hosts, bare www. hosts (which previously resulted in https:///attacker.com when www. was stripped), leading : or . after stripping www., control characters, and authority/path delimiters (/, \, @, ?, #).
2. Sanitize the target URI:
   • Falls back to req.URL.RequestURI() when req.RequestURI is empty or does not start with / (e.g., absolute-form requests), and passes the URI through sanitizeURI() to strip leading double slashes and percent-encode control characters.
3. Case-insensitive www. prefix handling:
   • Matches and strips www. case-insensitively (hasWWWPrefix / stripWWWPrefix) so WWW.example.com is handled consistently across WWWRedirect, NonWWWRedirect, HTTPSWWWRedirect, and HTTPSNonWWWRedirect.
4. Normalize WebSocket forwarding schemes:
   • Maps ws -> http and wss -> https when derived from c.Scheme() so WWWRedirect / NonWWWRedirect never emit ws:// or wss:// in Location headers.

Related Issue

Fixes #3217

Checklist

• Unit tests added in middleware/redirect_test.go (TestRedirectSecurityHardening)
• All existing tests pass (go test ./...)
• No breaking changes

[codecov]

Codecov Report

❌ Patch coverage is 96.55172% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 95.98%. Comparing base (dcb05f0) to head (20677a0).
⚠️ Report is 54 commits behind head on master.

Files with missing lines	Patch %	Lines
middleware/redirect.go	96.55%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #3218      +/-   ##
==========================================
+ Coverage   93.34%   95.98%   +2.63%     
==========================================
  Files          43       46       +3     
  Lines        4735     4281     -454     
==========================================
- Hits         4420     4109     -311     
+ Misses        192      172      -20     
+ Partials      123        0     -123     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.