Open redirect via protocol-relative trailing-slash normalization

Open redirect in Qwik City before 1.19.0 allows remote attackers to redirect users to attacker-controlled sites via crafted URLs. The default request handler’s fixTrailingSlash middleware converts an unnormalized path beginning with two slashes into a 301 Location header, which browsers treat as a protocol-relative destination. Exposure requires a deployment runtime with a catch-all path that matches arbitrary domains and does not normalize URL paths; successful exploitation supports phishing and token theft after a user follows the crafted link.