If redirecting to an absolute path (two leading slashes), a slash must be escaped to prevent browsers from handling the path as schemaless and redirecting to another host.
(url)
| 306 | |
| 307 | |
| 308 | def escape_leading_slashes(url): |
| 309 | """ |
| 310 | If redirecting to an absolute path (two leading slashes), a slash must be |
| 311 | escaped to prevent browsers from handling the path as schemaless and |
| 312 | redirecting to another host. |
| 313 | """ |
| 314 | if url.startswith("//"): |
| 315 | url = "/%2F{}".format(url.removeprefix("//")) |
| 316 | return url |
| 317 | |
| 318 | |
| 319 | def _parseparam(s): |