x/pkgsite: redirect bug

[dipuhasan]

Do you have bug bounty?

Redirect url:
https://pkg.go.dev///%5Cexample.com/
https://pkg.go.dev///%5Cgoogle.com/
https://pkg.go.dev///%5Cevil.com/

Thanks

[mvdan]

cc @jba

[seankhliao]

Note this appears to be browser specific (doesn't work with curl), treating Location: /\example.com as example.com
https://bugs.chromium.org/p/chromium/issues/detail?id=500610

[ianlancetaylor]

@dipuhasan This is an open source project. We don't have a bug bounty. But thanks for reporting the problem.

[gopherbot]

Change https://golang.org/cl/382160 mentions this issue: internal/frontend: use full URL in redirect