From 2cf30b2ca54369c192c029cc917599a400cb7c01 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 28 Oct 2026 03:09:37 +0000
Subject: [PATCH 1/2] Initial plan


From 59c71112297c5840699d315c8db4c9d155b4c8f4 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 28 Oct 2026 03:10:39 +0000
Subject: [PATCH 2/2] Apply remaining changes

Co-authored-by: ithewei <26049660+ithewei@users.noreply.github.com>
---
 http/server/HttpService.cpp | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/http/server/HttpService.cpp b/http/server/HttpService.cpp
index c28710e70..8d8109dc9 100644
--- a/http/server/HttpService.cpp
+++ b/http/server/HttpService.cpp
@@ -196,7 +196,16 @@ std::string HttpService::GetProxyUrl(const char* path) {
     std::string url;
     for (auto iter = proxies.begin(); iter != proxies.end(); ++iter) {
         if (hv_strstartswith(path, iter->first.c_str())) {
-            url = iter->second + (path + iter->first.length());
+            const char* rest = path + iter->first.length();
+            url = iter->second;
+            // authority-only target: make sure the sub path can't alter host (e.g. "@host")
+            size_t authority = url.find("://");
+            authority = authority == std::string::npos ? 0 : authority + 3;
+            bool has_path = url.find('/', authority) != std::string::npos;
+            if (!has_path && *rest != '\0' && *rest != '/') {
+                url += '/';
+            }
+            url += rest;
             break;
         }
     }