The sanitizer for our URL redirection queries is now more precise, so we no longer get false positives from things like:

res.redirect("/users/" + req.params.id);

The tricky thing about slashes is that they are used in multiple parts of the URL:

1. separating the (optional) scheme from the hostname
2. separating the hostname from the path
3. occurring inside the path, query, and/or fragment

The attacker must not be able to control the hostname, so we need to make sure a slash cannot be interpreted as (1). A redirection such as

res.redirect("/" + req.query.redirect)

is unsafe because it can lead to //evil.com.

I've also removed the Sink.maybeNonLocal() predicate from ServerSideUrlRedirect as it appears to implement the same sanitizer as the sanitizing prefix.

I'll run an evaluation, but just putting up for review now.