GHSA-5wvv-q5fv-2388 hyper-staticfile's location header incorporates user input, allowing open redirect

• crates.io hyper-staticfile: < 0.9.4 → fixed in 0.9.4 • crates.io hyper-staticfile: >= 0.10.0-alpha.1, < 0.10.0-alpha.5 → fixed in 0.10.0-alpha.5

When `hyper-staticfile` performs a redirect for a directory request (e.g. a request for `/dir` that redirects to `/dir/`), the `Location` header value was derived from user input (the request path), simply appending a slash. The intent was to perform an origin-relative redirect, but specific inputs allowed performing a scheme-relative redirect instead. An attacker could craft a special URL that would appear to be for the correct domain, but immediately redirects to a malicious domain. Such a URL can benefit phishing attacks, for example an innocent looking link in an email.