Giteabot e2517e0fa9 Fix forwarded proto handling for public URL detection (#36810) (#36836) ... Backport #36810 by @lunny - normalize `X-Forwarded-Proto`/related headers to accept only `http`/`https` - ignore malformed or injected scheme values to prevent spoofed canonical URLs - add tests covering malicious and multi-valued forwarded proto headers --- Generated by a coding agent with Codex 5.2 Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: silverwind <me@silverwind.io>		2026-03-06 19:02:50 +00:00
..
request.go	Fix missing Close when error occurs and abused connection pool (#35658) (#35670)	2025-10-15 09:56:53 +00:00
serve_test.go	Enable addtional linters (#34085)	2025-04-01 10:14:01 +00:00
serve.go	Fix external render, make iframe render work (#35727, #35730) (#35731)	2025-10-23 16:07:17 +08:00
url_test.go	Fix forwarded proto handling for public URL detection (#36810) (#36836)	2026-03-06 19:02:50 +00:00
url.go	Fix forwarded proto handling for public URL detection (#36810) (#36836)	2026-03-06 19:02:50 +00:00