MM-26425: Make URL parsing for image proxy more robust (#16197)

* MM-26425: Make URL parsing for image proxy more robust

- We don't bypass protocol relative URLs.
- We don't bypass hostnames with a similar prefix.

https: //mattermost.atlassian.net/browse/MM-26425

```release-note
NONE
```

* fix tests and incorporate review comments

* Handle opaque URLs

* Fix path tests

Co-authored-by: Mattermod <mattermod@users.noreply.github.com>

services/imageproxy/imageproxy_test.go

@@ -4,17 +4,23 @@
 package imageproxy
 
 import (
+	"net/url"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestGetProxiedImageURL(t *testing.T) {
 	siteURL := "https://mattermost.example.com"
+	parsedURL, err := url.Parse(siteURL)
+	require.NoError(t, err)
 
 	imageURL := "http://www.mattermost.org/wp-content/uploads/2016/03/logoHorizontal.png"
 	proxiedURL := "https://mattermost.example.com/api/v4/image?url=http%3A%2F%2Fwww.mattermost.org%2Fwp-content%2Fuploads%2F2016%2F03%2FlogoHorizontal.png"
 
+	proxy := ImageProxy{siteURL: parsedURL}
+
 	for _, test := range []struct {
 		Name     string
 		Input    string
@@ -28,7 +34,12 @@ func TestGetProxiedImageURL(t *testing.T) {
 		{
 			Name:     "should not proxy a relative image",
 			Input:    "/static/logo.png",
-			Expected: "/static/logo.png",
+			Expected: "https://mattermost.example.com/static/logo.png",
+		},
+		{
+			Name:     "should bypass opaque URLs",
+			Input:    "http:xyz123?query",
+			Expected: siteURL,
 		},
 		{
 			Name:     "should not proxy an image on the Mattermost server",
@@ -40,9 +51,24 @@ func TestGetProxiedImageURL(t *testing.T) {
 			Input:    proxiedURL,
 			Expected: proxiedURL,
 		},
+		{
+			Name:     "should not bypass protocol relative URLs",
+			Input:    "//mattermost.org/static/logo.png",
+			Expected: "https://mattermost.example.com/api/v4/image?url=https%3A%2F%2Fmattermost.org%2Fstatic%2Flogo.png",
+		},
+		{
+			Name:     "should not bypass if the host prefix is same",
+			Input:    "https://mattermost.example.com.anothersite.com/static/logo.png",
+			Expected: "https://mattermost.example.com/api/v4/image?url=https%3A%2F%2Fmattermost.example.com.anothersite.com%2Fstatic%2Flogo.png",
+		},
+		{
+			Name:     "should not bypass for user auth URLs",
+			Input:    "https://mattermost.example.com@anothersite.com/static/logo.png",
+			Expected: "https://mattermost.example.com/api/v4/image?url=https%3A%2F%2Fmattermost.example.com%40anothersite.com%2Fstatic%2Flogo.png",
+		},
 	} {
 		t.Run(test.Name, func(t *testing.T) {
-			assert.Equal(t, test.Expected, getProxiedImageURL(test.Input, siteURL))
+			assert.Equal(t, test.Expected, proxy.GetProxiedImageURL(test.Input))
 		})
 	}
 }