URL Redirection to Untrusted Site ('Open Redirect') in github.com/AndrewBurian/powermux

@@ -1 +1,3 @@
 module github.com/AndrewBurian/powermux
+
+go 1.14

@@ -1,6 +1,7 @@
 package powermux
 
 import (
+	"io"
 	"net/http"
 	"strings"
 )
@@ -51,3 +52,15 @@ func (r *Route) methodNotAllowed() http.Handler {
 
 	return nil
 }
+
+type badRequestHandler string
+
+func (brh badRequestHandler) ServeHTTP(res http.ResponseWriter, _ *http.Request) {
+	res.Header().Set("Content-Type", "text/plain")
+	res.WriteHeader(http.StatusBadRequest)
+	io.WriteString(res, string(brh))
+}
+
+func (r *Route) badRequest(errMsg string) http.Handler{
+	return badRequestHandler(errMsg)
+}
\ No newline at end of file

@@ -135,7 +135,13 @@ func newRoute() *Route {
 // a route.
 func (r *Route) execute(ex *routeExecution, method, pattern string) {
 
+	if strings.Contains(pattern, "//") {
+		ex.handler = r.badRequest("Invalid path")
+		return
+	}
+
 	pathParts := pathPartsPool.Get().([]string)[0:0]
+	defer pathPartsPool.Put(pathParts)
 	pathParts = append(pathParts, "")
 	start := 1
 	for i := 1; i < len(pattern); i++ {
@@ -146,6 +152,14 @@ func (r *Route) execute(ex *routeExecution, method, pattern string) {
 		}
 	}
 
+	// redirect trailing slashes
+	if pattern != "/" && strings.HasSuffix(pattern, "/") {
+		target := strings.TrimSuffix(pattern, "/")
+		ex.handler = http.RedirectHandler(target, http.StatusPermanentRedirect)
+		ex.pattern = target
+		return
+	}
+
 	// get the trailing path param
 	if pattern != "/" {
 		pathParts = append(pathParts, pattern[start:])
@@ -154,8 +168,6 @@ func (r *Route) execute(ex *routeExecution, method, pattern string) {
 	// Fill the execution
 	r.getExecution(method, pathParts, ex)
 
-	// return path parts
-	pathPartsPool.Put(pathParts)
 }
 
 // getExecution is a recursive step in the tree traversal. It checks to see if this node matches,

@@ -0,0 +1,73 @@
+package powermux
+
+import (
+	"fmt"
+	"testing"
+	"net/http"
+	"net/http/httptest"
+	"bytes"
+)
+
+type RouteTest struct {
+	route          string
+	body           string
+	method         string
+	expectCode     int
+	expectLocation string
+}
+
+var routeTests = []RouteTest{
+	{
+		route:      "/",
+		expectCode: http.StatusNotFound,
+	},
+	{
+		route:          "/foo/",
+		expectLocation: "/foo",
+	},
+	{
+		route:      "//example.com/",
+		expectCode: http.StatusBadRequest,
+	},
+	{
+		route:      "/foo//bar",
+		expectCode: http.StatusBadRequest,
+	},
+}
+
+func TestMuxRoutes(t *testing.T) {
+
+	mux := NewServeMux()
+	for _, tt := range routeTests {
+
+		// sane defaults
+		if tt.expectCode == 0 {
+			if tt.expectLocation != "" {
+				tt.expectCode = http.StatusPermanentRedirect
+			} else {
+				tt.expectCode = http.StatusOK
+			}
+		}
+		if tt.method == "" {
+			tt.method = http.MethodGet
+		}
+
+		t.Run(fmt.Sprintf("%s%s", tt.method, tt.route), func(t *testing.T) {
+			rec := httptest.NewRecorder()
+			req := httptest.NewRequest(tt.method, tt.route, bytes.NewBufferString(tt.body))
+			mux.ServeHTTP(rec, req)
+
+			if rec.Code != tt.expectCode {
+				t.Fatalf("Unexpected status code, expected=%d actual=%d", tt.expectCode, rec.Code)
+			}
+
+			if tt.expectLocation != "" && (rec.Code / 100) != 3 {
+				t.Fatalf("Expected redirect, instead got code %d", rec.Code)
+			}
+
+			if tt.expectLocation != "" && tt.expectLocation != rec.Header().Get("Location") {
+				t.Fatalf("Mismatched redirect. expected=%s, actual=%s", tt.expectLocation, rec.Header().Get("Location"))
+			}
+		})
+	}
+}

@@ -4,7 +4,6 @@ import (
 	"bytes"
 	"context"
 	"net/http"
-	"strings"
 )
 
 // ServeMux is the multiplexer for http requests
@@ -68,14 +67,6 @@ func NewServeMux() *ServeMux {
 func (s *ServeMux) getAll(r *http.Request, ex *routeExecution) {
 	path := r.URL.EscapedPath()
 
-	// Check for redirect
-	if path != "/" && strings.HasSuffix(path, "/") {
-		r.URL.Path = strings.TrimRight(path, "/")
-		ex.handler = http.RedirectHandler(r.URL.RequestURI(), http.StatusPermanentRedirect)
-		ex.pattern = r.URL.EscapedPath()
-		return
-	}
-
 	// fill it
 	if route, ok := s.hostRoutes[r.URL.Host]; ok {
 		route.execute(ex, r.Method, path)