GHSA-vhj5-x93p-67jw

### Summary `actix-web-lab` redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, `https://{hostname}{path}`). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the `Location` response header, causing open redirect/phishing behavior.

### CVE Assigned CVE ID: CVE-2025-63762

### Details The issue is in redirect middleware paths that construct absolute URLs from `req.connection_info()`:

1. `actix-web-lab/src/redirect_to_https.rs` (around lines 119-132) - `let host = conn_info.host();` - `format!("https://{hostname}{path}")` - `format!("https://{hostname}:{port}{path}")`

2. `actix-web-lab/src/redirect_to_www.rs` (around lines 30-35) - `format!("{scheme}://www.{host}{path}")`

3. `actix-web-lab/src/redirect_to_non_www.rs` (around lines 30-34) - `format!("{scheme}://{host_no_www}{path}")`

Because host values come from request connection metadata, untrusted Host input can influence redirect targets when deployment-side host validation is missing.

### PoC Environment used for validation: - Local minimal Actix apps using `actix-web-lab` middleware - RedirectHttps: `http://127.0.0.1:18080` - redirect_to_www: `http://127.0.0.1:18081` - redirect_to_non_www: `http://127.0.0.1:18082`

Reproduction (RedirectHttps): ```bash curl.exe -i -s "http://127.0.0.1:18080/test" -H "Host: attacker.example" ```

Observed response: ```http HTTP/1.1 307 Temporary Redirect location: https://attacker.example/test ```

Additional verification: ```bash curl.exe -i -s "http://127.0.0.1:18080/abc/def" -H "Host: evil.example:9999" ```

Observed response: ```http HTTP/1.1 307 Temporary Redirect location: https://evil.example/abc/def ```

Reproduction (redirect_to_www): ```bash curl.exe -i -s "http://127.0.0.1:18081/hello" -H "Host: attacker.example" ```

Observed response: ```http HTTP/1.1 307 Temporary Redirect location: http://www.attacker.example/hello ```

Reproduction (redirect_to_non_www): ```bash curl.exe -i -s "http://127.0.0.1:18082/path" -H "Host: www.attacker.example" ```

Observed response: ```http HTTP/1.1 307 Temporary Redirect location: http://attacker.example/path ```

### Impact This is a Host header poisoning / open redirect issue. Users can be redirected to attacker-controlled domains, enabling phishing and trust-boundary abuse. Any application using these middleware paths without strict host validation (proxy/app allowlisting) is impacted.