Clarify that only a path should be passed

modules/caddyhttp/fileserver/staticfiles.go

@@ -639,16 +639,18 @@ func calculateEtag(d os.FileInfo) string {
 	return `"` + t + s + `"`
 }
 
-func redirect(w http.ResponseWriter, r *http.Request, to string) error {
-	for strings.HasPrefix(to, "//") {
+// redirect performs a redirect to a given path. The 'toPath' parameter
+// MUST be solely a path, and MUST NOT include a query.
+func redirect(w http.ResponseWriter, r *http.Request, toPath string) error {
+	for strings.HasPrefix(toPath, "//") {
 		// prevent path-based open redirects
-		to = strings.TrimPrefix(to, "/")
+		toPath = strings.TrimPrefix(toPath, "/")
 	}
 	// preserve the query string if present
 	if r.URL.RawQuery != "" {
-		to += "?" + r.URL.RawQuery
+		toPath += "?" + r.URL.RawQuery
 	}
-	http.Redirect(w, r, to, http.StatusPermanentRedirect)
+	http.Redirect(w, r, toPath, http.StatusPermanentRedirect)
 	return nil
 }