fix: image and URL references refuse a /\ path, which browsers read as another host (WR-20)

safeImageURL and ValidURLRef refused only //, so a stored og_image of
/\evil.example/x.png loaded a third-party image in the admin. Both now
refuse /\ like models.validTarget already does.

classes/field_types.go

@@ -152,14 +152,15 @@ func decodeImage(_ context.Context, in pact.FormFieldValue) (pact.FormFieldDecod
 	return pact.FormFieldDecoded{Value: s}, nil
 }
 
-// ValidURLRef reports whether v is a path ("/x", not "//x") or an absolute
-// http(s) URL with a host, without spaces or control characters.
+// ValidURLRef reports whether v is a path ("/x", not "//x" or "/\x",
+// which browsers read as another host) or an absolute http(s) URL with a
+// host, without spaces or control characters.
 func ValidURLRef(v string) bool {
 	if v == "" || strings.ContainsFunc(v, func(r rune) bool { return r <= ' ' || r == 0x7f }) {
 		return false
 	}
 	if strings.HasPrefix(v, "/") {
-		return !strings.HasPrefix(v, "//")
+		return !strings.HasPrefix(v, "//") && !strings.HasPrefix(v, `/\`)
 	}
 	u, err := url.Parse(v)
 	return err == nil && (u.Scheme == "http" || u.Scheme == "https") && u.Host != ""

classes/urlref_test.go

@@ -0,0 +1,30 @@
+package classes
+
+import "testing"
+
+// TestValidURLRef: a path or an absolute http(s) URL; a path that browsers
+// read as another host (// or /\) is refused (WR-20).
+func TestValidURLRef(t *testing.T) {
+	for v, want := range map[string]bool{
+		"/media/a.png":              true,
+		"https://cdn.example/a.png": true,
+		"http://cdn.example/a.png":  true,
+		"//evil.example/x.png":      false,
+		`/\evil.example/x.png`:      false,
+		"javascript:alert(1)":       false,
+		"data:image/png;base64,AA":  false,
+		"a.png":                     false,
+		"/a b.png":                  false,
+		"":                          false,
+	} {
+		if got := ValidURLRef(v); got != want {
+			t.Errorf("ValidURLRef(%q) = %v, want %v", v, got, want)
+		}
+	}
+	if !ValidImageURL("") {
+		t.Error("ValidImageURL(\"\") = false, want true (no image)")
+	}
+	if ValidImageURL(`/\evil.example/x.png`) {
+		t.Error(`ValidImageURL("/\evil.example/x.png") = true, want false`)
+	}
+}