Open Redirect in st
st is a module for serving static files.An attacker is able to craft a request that results in an `HTTP 301` (redirect) to an entirely different domain.A request for: `http://some.server.com//nodesecurity.org/%2e%2e` would result in a 301 to `//nodesecurity.org/%2e%2e` which most browsers treat as a proper redirect as `//` is translated into the current schema being used.**Mitigating factor:**In order for this to work, `st` must be serving from the root of a server (`/`) rather than the typical sub directory (`/static/`) and the redirect URL will end with some form of URL encoded `..` ("%2e%2e", "%2e.", ".%2e").Code example (provided by Xin Gao):[example.js]RecommendationUpdate to version 1.2.2 or later.