Backport of fix path cleaning of proxied urls into release/1.21.x

[hc-github-team-consul-core]

Backport

This PR is auto-generated from #22671 to be assessed for backporting due to the inclusion of the label backport/1.21.

The below text is copied from the body of the original PR.

---

Description

This pull request addresses a security issue in the UIMetricsProxy handler by improving how proxied URL paths are cleaned and validated to prevent path traversal attacks. The main focus is on ensuring that user-supplied paths cannot escape the intended base URL, even in edge cases.

Security improvements to URL path handling:

• Paths are now cleaned using path.Clean with a leading slash to ensure that any ../ segments are properly removed, preventing path traversal attacks. (agent/ui_endpoint.go)
• The previous redundant cleaning of the parsed URL path after construction has been removed, as the cleaning is now handled earlier and more securely. (agent/ui_endpoint.go)

Base URL validation enhancements:

• The check for whether the target URL is within the base URL now ensures the base URL has a trailing slash for proper prefix matching, and allows an exact match of the base URL without the trailing slash. This prevents attackers from escaping the base path by manipulating the URL. (agent/ui_endpoint.go)

Testing & Reproduction steps

Links

PR Checklist

• updated test coverage
• external facing docs updated
• appropriate backport labels added
• not a security concern

PCI review checklist

• I have documented a clear reason for, and description of, the change I am making.

• If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.

• If applicable, I've documented the impact of any changes to security controls.

  Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.

---

Overview of commits

• f278040

[github-team-consul-core-pr-approver]

Auto approved Consul Bot automated PR