Prevent open redirects when cleanUrls config is enabled

src/index.js

@@ -127,15 +127,19 @@ const shouldRedirect = (decodedPath, {redirects = [], trailingSlash}, cleanUrl)
 		return null;
 	}
 
-	let cleanedUrl = false;
-
 	// By stripping the HTML parts from the decoded
 	// path *before* handling the trailing slash, we make
 	// sure that only *one* redirect occurs if both
 	// config options are used.
 	if (cleanUrl && matchHTML.test(decodedPath)) {
 		decodedPath = decodedPath.replace(matchHTML, '');
-		cleanedUrl = true;
+		if (decodedPath.indexOf('//') > -1) {
+			decodedPath = decodedPath.replace(/\/+/g, '/');
+		}
+		return {
+			target: ensureSlashStart(decodedPath),
+			statusCode: defaultType
+		};
 	}
 
 	if (slashing) {
@@ -163,13 +167,6 @@ const shouldRedirect = (decodedPath, {redirects = [], trailingSlash}, cleanUrl)
 		}
 	}
 
-	if (cleanedUrl) {
-		return {
-			target: ensureSlashStart(decodedPath),
-			statusCode: defaultType
-		};
-	}
-
 	// This is currently the fastest way to
 	// iterate over an array
 	for (let index = 0; index < redirects.length; index++) {
@@ -412,6 +409,7 @@ const renderDirectory = async (current, acceptsJSON, handlers, methods, config,
 			return 1;
 		}
 
+		/* istanbul ignore next */
 		if (a.base < b.base) {
 			return -1;
 		}

test/integration.js

@@ -278,6 +278,20 @@ test('set `trailingSlash` config property to `false`', async t => {
 	t.is(location, target);
 });
 
+test('set `cleanUrls` config property should prevent open redirects', async t => {
+	const url = await getUrl({
+		cleanUrls: true
+	});
+
+	const response = await fetch(`${url}//haveibeenpwned.com/index`, {
+		redirect: 'manual',
+		follow: 0
+	});
+
+	const location = response.headers.get('location');
+	t.is(location, `${url}/haveibeenpwned.com`);
+});
+
 test('set `rewrites` config property to wildcard path', async t => {
 	const destination = '.dotfile';
 	const related = path.join(fixturesFull, destination);