GHSA-mqqf-5wvp-8fh8 — chi has an open redirect vulnerability in the RedirectSlashes middleware

Affected: Go: github.com/go-chi/chi/v5

### Summary

The `RedirectSlashes` function in middleware/strip.go does not perform correct input validation and can lead to an open redirect vulnerability.

### Details

The `RedirectSlashes` function performs a `Trim` to all forward slash (`/`) characters, while prepending a single one at the begining of the path (Line 52).

However, it does not trim backslashes (`\`).

```go File: middleware/strip.go 41: func RedirectSlashes(next http.Handler) http.Handler { ... 51: // Trim all leading and trailing slashes (e.g., "//evil.com", "/some/path//") 52: path = "/" + strings.Trim(path, "/") ... 62: } ```

Also, from version 5.2.2 onwards the `RedirectSlashes` function does not take into consideration the `Host` Header in the redirect response returned. This was done in order to combat another [[vulnerability](https://github.com/go-chi/chi/security/advisories/GHSA-vrw8-fxc6-2r93)](https://github.com/go-chi/chi/security/advisories/GHSA-vrw8-fxc6-2r93).

The above make it possible for a response in the following form:

``` HTTP/1.1 301 Moved Permanently Location: /\evil.com ```

The `/\evil.com` will be transformed by most browsers (Chrome, Firefox, etc. not Safari) into `//evil.com` which is a protocol relative URL and will result in a redirect to `evil.com`, essentially making it an open redirect vulnerability.

### PoC

A minimal working example can be seen below.

```go package main

import ( "fmt" "net/http"

"github.com/go-chi/chi/v5" "github.com/go-chi/chi/v5/middle…

Most recent entries from all

GHSA-mqqf-5wvp-8fh8 — chi has an open redirect vulnerability in the RedirectSlashes middleware