mirror of
https://github.com/lunchcat/sif.git
synced 2026-07-28 14:37:01 -07:00
TigahandGitHub
e8eee5c530
pointsAtSentinel parsed the reflected location without the whitespace and control-byte removal a browser applies, so payloads like a space-prefixed scheme-relative host or a tab embedded in the scheme parsed to an empty host and a real off-site redirect was missed. strip leading and trailing c0-or-space and all tab, cr and lf before parsing, matching the navigation-time normalization, without removing mid-string spaces so a same-site target is never reclassified as off-site.