Wrong redirect edge case

[lydell]

esbuild’s server redirects to add a trailing slash for directories. I found an edge case there. If the path starts with 2 or more slashes, the redirect does not work – because it becomes a protocol relative URL. So esbuild effectively tries to redirect to http://name_of_folder/.

To reproduce, make a new folder and run:

❯ npm init -y >/dev/null

❯ npm i esbuild

added 2 packages, and audited 3 packages in 2s

found 0 vulnerabilities

❯ npx esbuild --version
0.18.11

❯ npx esbuild --serve --servedir=.

 > Local:   http://127.0.0.1:8000/

And in another tab:

❯ curl -IL http://127.0.0.1:8000//node_modules
HTTP/1.1 302 Found
Access-Control-Allow-Origin: *
Location: //node_modules/
Date: Sun, 02 Jul 2023 19:40:04 GMT

curl: (6) Could not resolve host: node_modules

Here’s a fun extra thing you can do:

❯ mkdir google.com

❯ curl -IL http://127.0.0.1:8000//google.com
HTTP/1.1 302 Found
Access-Control-Allow-Origin: *
Location: //google.com/
Date: Sun, 02 Jul 2023 19:42:15 GMT

HTTP/1.1 301 Moved Permanently
Location: http://www.google.com/
Content-Type: text/html; charset=UTF-8
...