[vishr]

Summary

Fixes #3217.

Removing a bare www. Host can produce https:///attacker.com/login. Reject empty, leading colon/dot, or percent-bearing redirect hosts with HTTP 400. Rely on net/http for Host syntax validation, and do the additional checks only when a redirect is needed.

skip asterisk target
normalize scheme -> decide redirect
if redirect: validate host -> resolve request path -> escape controls -> respond

WWW matching is case-insensitive. Empty or absolute-form request targets fall back to URL.RequestURI(); ws/wss become HTTP schemes. OPTIONS * passes through without constructing a Location.

Related: #3218. Leading double slashes remain part of the path when the validated host already anchors an absolute URL.

Evidence

• Before: a bare-WWW request emits an unsafe redirect on master; the initial fix passed invalid hosts to the application with 200. OPTIONS * emitted https://example.com*.
  After: tests assert 400 and no application-handler call when an invalid host requires a redirect, including over TCP HTTP. Asterisk targets and requests that need no redirect reach the next handler.
• Coverage includes all five middlewares, valid IPv6 authorities and ports, empty/absolute-form targets, control characters, mixed-case WWW prefixes, and trusted WebSocket schemes.
• Independent branch: GOTOOLCHAIN=go1.27.4 go test -race ./..., go vet ./..., golint -set_exit_status ./..., and current staticcheck pass.

Merge Danger

Door: two-way

Blast Radius: redirects

Requests requiring a redirect now return 400 for the additional invalid-host cases, including percent-bearing zoned IPv6 authorities. Canonical requests and asterisk targets pass through without redirect validation.