From c570a32c219c957fd405ed018f2500f06952c043 Mon Sep 17 00:00:00 2001
From: "E. Westbrook" <github@westbrook.io>
Date: Tue, 21 Aug 2018 09:07:42 -0600
Subject: url.lua:remove_dot_components(): limit beginning-of-string double-dot
 corner case to prevent triple-dot activation and authority collision

---
 src/url.lua | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'src')

diff --git a/src/url.lua b/src/url.lua
index a354ab5..0d88adb 100644
--- a/src/url.lua
+++ b/src/url.lua
@@ -94,7 +94,7 @@ local function remove_dot_components(path)
     path = path:gsub('[^/]+/%.%./*$', '')
     path = path:gsub('/%.%.$', '/')
     path = path:gsub('/%.$', '/')
-    path = path:gsub('^/%.%.', '')
+    path = path:gsub('^/%.%./', '/')
     return path
 end
 
-- 
cgit v1.2.3-55-g6feb