GHSA-cf57-c578-7jvv: Anubis vulnerable to possible XSS via redir parameter when using subrequest auth mode

The vulnerability lies in the lack of input validation for redirect URLs in Anubis's subrequest authentication mode. The analysis of the patch commit 7ed1753fcced351c81961bf520a7bfb2caac6e88 reveals modifications in lib/http.go that address this issue. Two functions were identified as vulnerable:

1. Server.constructRedirectURL: This function constructs a redirect URL based on X-Forwarded-* headers. Before the patch, it did not validate the X-Forwarded-Proto header, allowing schemes like javascript:. The patch introduces a validation to only allow http and https protocols.

2. Server.ServeHTTPNext: This function handles the /.within.website/ endpoint and processes the redir query parameter. The original code used url.Parse, which is too permissive. The patch replaces it with url.ParseRequestURI and adds explicit scheme validation to prevent schemes like javascript:, data:, etc.

Both functions are part of the Server struct and are directly involved in handling and constructing redirect URLs. Exploitation would involve a user clicking a crafted link that triggers the subrequest authentication flow with a malicious redir parameter or specially crafted X-Forwarded-Proto header, potentially leading to XSS.