fix: image and URL references refuse a /\ path, which browsers read as another host (WR-20)

safeImageURL and ValidURLRef refused only //, so a stored og_image of
/\evil.example/x.png loaded a third-party image in the admin. Both now
refuse /\ like models.validTarget already does.

classes/urlref_test.go

@@ -0,0 +1,30 @@
+package classes
+
+import "testing"
+
+// TestValidURLRef: a path or an absolute http(s) URL; a path that browsers
+// read as another host (// or /\) is refused (WR-20).
+func TestValidURLRef(t *testing.T) {
+	for v, want := range map[string]bool{
+		"/media/a.png":              true,
+		"https://cdn.example/a.png": true,
+		"http://cdn.example/a.png":  true,
+		"//evil.example/x.png":      false,
+		`/\evil.example/x.png`:      false,
+		"javascript:alert(1)":       false,
+		"data:image/png;base64,AA":  false,
+		"a.png":                     false,
+		"/a b.png":                  false,
+		"":                          false,
+	} {
+		if got := ValidURLRef(v); got != want {
+			t.Errorf("ValidURLRef(%q) = %v, want %v", v, got, want)
+		}
+	}
+	if !ValidImageURL("") {
+		t.Error("ValidImageURL(\"\") = false, want true (no image)")
+	}
+	if ValidImageURL(`/\evil.example/x.png`) {
+		t.Error(`ValidImageURL("/\evil.example/x.png") = true, want false`)
+	}
+}