From f338886bd373f1e896f28d03c52fe093060815ed Mon Sep 17 00:00:00 2001
From: qwenbona <qwenbona@users.noreply.github.com>
Date: Tue, 28 Jul 2026 01:14:38 +0200
Subject: [PATCH] fix(markdown): block /\ protocol-relative redirect in safeUrl
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Browsers normalise `\` to `/`, so `href="/\evil.com"` resolves to
`//evil.com` — an off-site open redirect. The existing guard only
rejected `//`; extend the negative lookahead to also reject `/\`.

Fixes #47
---
 lib/markdown.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/markdown.ts b/lib/markdown.ts
index 8ed936d..873e8e1 100644
--- a/lib/markdown.ts
+++ b/lib/markdown.ts
@@ -12,7 +12,7 @@ const escapeHtml = (s: string): string =>
 function safeUrl(raw: string): string | null {
   const u = raw.trim();
   if (/^(https?:|mailto:)/i.test(u)) return u;
-  if (/^\/(?!\/)/.test(u)) return u; // "/path" but not "//host"
+  if (/^\/(?![/\\])/.test(u)) return u; // "/path" but not "//host" or "/\host"
   if (/^#/.test(u)) return u;
   return null;
 }