hls, webrtc: prevent XSS attack when appending slash to paths (#2766) (#2767) (#2772)

internal/protocols/httpserv/location_with_trailing_slash.go

@@ -0,0 +1,12 @@
+package httpserv
+
+import "net/url"
+
+// LocationWithTrailingSlash returns the URL in a relative format, with a trailing slash.
+func LocationWithTrailingSlash(u *url.URL) string {
+	l := "./" + u.Path[1:] + "/"
+	if u.RawQuery != "" {
+		l += "?" + u.RawQuery
+	}
+	return l
+}

internal/protocols/httpserv/location_with_trailing_slash_test.go

@@ -0,0 +1,36 @@
+package httpserv
+
+import (
+	"net/url"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestLocationWithTrailingSlash(t *testing.T) {
+	for _, ca := range []struct {
+		name string
+		url  *url.URL
+		loc  string
+	}{
+		{
+			"with query",
+			&url.URL{
+				Path:     "/test",
+				RawQuery: "key=value",
+			},
+			"./test/?key=value",
+		},
+		{
+			"xss",
+			&url.URL{
+				Path: "/www.example.com",
+			},
+			"./www.example.com/",
+		},
+	} {
+		t.Run(ca.name, func(t *testing.T) {
+			require.Equal(t, ca.loc, LocationWithTrailingSlash(ca.url))
+		})
+	}
+}