Resolve same-scheme redirects without an authority against the URL (aio-libs#13855)

<!-- Thank you for your contribution! -->

## What do these changes do?

A redirect `Location` that has the scheme of the current URL but no
`//`, such as `http:/path` or `http:path`, is now joined with the
current URL, as browsers and the WHATWG URL Standard resolve it.
Previously only a `Location` without a scheme was joined, so
`http:/example.com` was taken as an absolute URL without a host and
failed with `InvalidUrlRedirectClientError`.

This is needed for aio-libs/yarl#1937, where yarl reads
`http:example.com/` as `http://example.com/` in its default WHATWG mode.
Without the join, aiohttp would follow `Location: http:/example.com` to
the host `example.com`, while a browser stays on the current host.
`Location: http:///example.com` is left as it was (still rejected):
browsers read it as the host `example.com`, which `URL.join()` does not
do. The check for `//` normalizes the Location as URL parsers do
(surrounding C0 controls and spaces stripped, tabs and newlines dropped)
and reads a backslash like a slash, as browsers do for http and https.

`http:/example.com` is removed from the invalid URL test data: a request
to it is invalid with the released yarl but goes to `example.com` with
yarl#1937. As a redirect it now resolves on both.

## Are there changes in behavior for the user?

Yes. `Location: http:/path`, `http:path` and `http:/` now redirect to
that path on the current host instead of raising
`InvalidUrlRedirectClientError`.

## Is it a substantial burden for the maintainers to support this?

No, it is one condition in the redirect handling.

## Related issue number

Needed by aio-libs/yarl#1937, whose "Aiohttp tests" job fails on
`http:/example.com` without it.

## Checklist

- [x] I think the code is well written
- [x] Unit tests for the changes exist
- [ ] Documentation reflects the changes: N/A, no documented behavior
changes
- [ ] If you provide code modification, please add yourself to
`CONTRIBUTORS.txt`: N/A, already listed
- [x] Add a new news fragment into the `CHANGES/` folder

Drafted with Claude Code (Claude Opus 5.5); reviewed by @asvetlov.

<details>
<summary>Agent run details (optional, for reviewers)</summary>

Tests: `AIOHTTP_NO_EXTENSIONS=1 pytest tests -n auto`, 4796 passed, 60
skipped, 14 xfailed, both with yarl master (f761c37) and with the
yarl#1937 branch.
Lint: black, isort, codespell passed; flake8 (E, F, W) passed when run
directly, because the local pre-commit flake8 hook fails to load
`flake8-requirements` (`pkg_resources` missing); mypy on
`aiohttp/client.py` reports the same unrelated errors as on master.
</details>

Author: asvetlov

CHANGES/13855.bugfix.rst

@@ -0,0 +1,5 @@
+Resolved a redirect ``Location`` with the scheme of the current URL but
+without ``//``, such as ``http:/path`` or ``http:path``, against the
+current URL, as browsers do, instead of treating it as an absolute URL
+without a host
+-- by :user:`asvetlov`.

aiohttp/client.py

@@ -168,6 +168,22 @@
     from typing import Unpack
 
 
+# URL parsers strip leading and trailing C0 control characters and spaces and
+# drop tabs and newlines before splitting a URL.
+_C0_CONTROL_OR_SPACE = "".join(map(chr, range(0x21)))
+_REMOVE_TAB_OR_NEWLINE = str.maketrans("", "", "\t\n\r")
+
+
+def _has_no_authority(location: str, scheme: str) -> bool:
+    """Tell if a URL with a scheme has no "//" after the scheme.
+
+    Browsers read a backslash like a slash there for http and https.
+    """
+    location = location.strip(_C0_CONTROL_OR_SPACE).translate(_REMOVE_TAB_OR_NEWLINE)
+    rest = location[len(scheme) + 1 : len(scheme) + 3]
+    return rest[:1] not in ("/", "\\") or rest[1:] not in ("/", "\\")
+
+
 class _RequestOptions(TypedDict, total=False):
     params: Query
     data: Any
@@ -834,7 +850,11 @@ async def _request(
                                 await req._body.close()
                             resp.close()
                             raise NonHttpUrlRedirectClientError(r_url)
-                        elif not scheme:
+                        elif not scheme or (
+                            scheme == url.scheme and _has_no_authority(r_url, scheme)
+                        ):
+                            # "http:/path" or "http:path" is a reference to
+                            # the current URL, as browsers resolve it.
                             parsed_redirect_url = url.join(parsed_redirect_url)
 
                         try:

tests/test_client_functional.py

@@ -1006,6 +1006,38 @@ async def handler_ok(request: web.Request) -> web.Response:
         assert resp.url.path == "/ok"
 
 
+@pytest.mark.parametrize(
+    ("location", "path", "query"),
+    (
+        ("http:/ok", "/ok", {}),
+        ("http:ok", "/ok", {}),
+        ("http:/ok?a=b", "/ok", {"a": "b"}),
+        ("http:/", "/", {}),
+    ),
+)
+async def test_redirect_same_scheme_without_authority(
+    aiohttp_client: AiohttpClient, location: str, path: str, query: dict[str, str]
+) -> None:
+    async def handler_redirect(request: web.Request) -> web.Response:
+        return web.Response(status=301, headers={"Location": location})
+
+    async def handler_ok(request: web.Request) -> web.Response:
+        assert dict(request.query) == query
+        return web.Response(status=200)
+
+    app = web.Application()
+    app.router.add_route("GET", path, handler_ok)
+    app.router.add_route("GET", "/redirect", handler_redirect)
+    client = await aiohttp_client(app)
+
+    async with client.get("/redirect") as resp:
+        assert resp.status == 200
+        assert resp.url.host == "127.0.0.1"
+        assert resp.url.path == path
+        assert dict(resp.url.query) == query
+        assert len(resp.history) == 1
+
+
 async def test_history(aiohttp_client: AiohttpClient) -> None:
     async def handler_redirect(request: web.Request) -> web.Response:
         return web.Response(status=301, headers={"Location": "/ok"})
@@ -3213,7 +3245,12 @@ async def handler_redirect(request: web.Request) -> web.Response:
 INVALID_URL_WITH_ERROR_MESSAGE_YARL_ORIGIN = (
     # # yarl.URL.origin raises ValueError
     ("http:/", "http:///"),
-    ("http:/example.com", "http:///example.com"),
+    ("http:///example.com", "http:///example.com"),
+)
+
+# A redirect to "http:/" resolves against the current URL, see
+# test_redirect_same_scheme_without_authority().
+INVALID_REDIRECT_URL_WITH_ERROR_MESSAGE_YARL_ORIGIN = (
     ("http:///example.com", "http:///example.com"),
 )
 
@@ -3259,7 +3296,7 @@ async def test_invalid_and_non_http_url(
     (
         *(
             (url, message, InvalidUrlRedirectClientError)
-            for (url, message) in INVALID_URL_WITH_ERROR_MESSAGE_YARL_ORIGIN
+            for (url, message) in INVALID_REDIRECT_URL_WITH_ERROR_MESSAGE_YARL_ORIGIN
             + INVALID_URL_WITH_ERROR_MESSAGE_YARL_NEW
         ),
         *(
@@ -3294,7 +3331,7 @@ async def generate_redirecting_response(request: web.Request) -> web.Response:
     (
         *(
             (url, message, InvalidUrlRedirectClientError)
-            for (url, message) in INVALID_URL_WITH_ERROR_MESSAGE_YARL_ORIGIN
+            for (url, message) in INVALID_REDIRECT_URL_WITH_ERROR_MESSAGE_YARL_ORIGIN
             + INVALID_URL_WITH_ERROR_MESSAGE_YARL_NEW
         ),
         *(

tests/test_client_session.py

@@ -1729,3 +1729,25 @@ async def test_netrc_auth_host_not_in_netrc(auth_server: TestServer) -> None:
         text = await resp.text()
         # Should not have auth since the host is not in netrc
         assert text == "no_auth"
+
+
+@pytest.mark.parametrize(
+    ("location", "expected"),
+    (
+        ("http:/ok", True),
+        ("http:ok", True),
+        ("http:", True),
+        ("http:/", True),
+        ("http://example.com/", False),
+        ("http:///example.com", False),
+        ("  http:///example.com", False),
+        ("\x00http:///example.com", False),
+        ("http:/\t/example.com", False),
+        ("http:/\n/example.com", False),
+        ("http:\\\\example.com", False),
+        ("http:\\/example.com", False),
+        ("http:/\\example.com", False),
+    ),
+)
+def test_has_no_authority(location: str, expected: bool) -> None:
+    assert client._has_no_authority(location, "http") is expected