Sanitize redirect URLs to prevent XSS and header injection

[TristanInSec]

Summary

• Fix reflected XSS in redirect response bodies (CWE-79)
• Fix HTTP response splitting via CRLF injection in redirect Location header (CWE-113)

Both issues affect the redirect() function when --forward, --forward-all, or --https-redirect is configured. URL-decoded paths are placed unsanitized into both the HTML body and the Location header.

Changes

• Add html_escape() to encode < > & " ' in the HTML response body
• Add strip_crlf() to remove \r and \n from the Location header value
• The existing append_escaped() in generate_dir_listing() uses the apbuf interface and cannot be reused here

Test

# Start with forwarding enabled
./darkhttpd /tmp/test --port 8080 --forward-all http://example.com

# XSS: body should show &lt;script&gt; (escaped), not raw <script>
curl -D- "http://127.0.0.1:8080/%3Cscript%3Ealert(1)%3C/script%3E"

# CRLF: Set-Cookie should appear inside Location value, not as separate header
curl -D- "http://127.0.0.1:8080/%0d%0aSet-Cookie:%20evil=1"