Method checkRedirectHost

github/github.go:2076–2090

checkRedirectHost returns an error if the redirect target is on a different host than the client's configured BaseURL. This prevents credentials attached by the auth transport from being sent to an attacker-controlled host when a compromised or malicious API response returns a cross-origin Location

(location string)

// compromised or malicious API response returns a cross-origin Location header.
// An empty Location is also rejected.
func (c *Client) checkRedirectHost(location string) error {
	if location == "" {
		return errInvalidLocation
	}
	target, err := url.Parse(location)
	if err != nil {
		return fmt.Errorf("invalid redirect location %q: %w", location, err)
	}
	// Resolve relative locations against BaseURL so relative paths are allowed.
	target = c.baseURL.ResolveReference(target)
	if target.Host != c.baseURL.Host {
		return fmt.Errorf("refusing to follow cross-host redirect from %q to %q", c.baseURL.Host, target.Host)
	}
	return nil
}

// Ptr is a helper routine that allocates a new T value
// to store v and returns a pointer to it.