it('should allow legitimate protocol-relative URLs', async () => {
          ref.injector.get(NgZone).run(() => {
            http.get('//example.com/testing').subscribe((body) => {
              expect(body).toEqual('success!');
            });
            mock.expectOne('http://example.com/testing').flush('success!');
          });
        });

        it('should treat backslash bypass SSRF attempts in relative requests strictly as pathnames', async () => {
          const badUrls = [
            '/\\attacker.com',
            '\\\\attacker.com',
            '///attacker.com',
            '//\\attacker.com',
            '  /\\attacker.com',
            '\r\n/\\attacker.com',
          ];

          ref.injector.get(NgZone).run(() => {
            for (const badUrl of badUrls) {
              http.get(badUrl).subscribe((body) => {
                expect(body).toEqual('success!');
              });
              mock.expectOne('http://localhost:4000/attacker.com').flush('success!');
            }
          });
        });

        it('should resolve safe path-relative URLs containing backslashes without origin change', async () => {
          ref.injector.get(NgZone).run(() => {
            http.get('\\testing').subscribe((body) => {
              expect(body).toEqual('success!');
            });
            mock.expectOne('http://localhost:4000/testing').flush('success!');
          });
        });

        it('should resolve backslashes inside path-relative segments without origin change', async () => {
          ref.injector.get(NgZone).run(() => {
            http.get('/foo\\bar').subscribe((body) => {
              expect(body).toEqual('success!');
            });
            mock.expectOne('http://localhost:4000/foo/bar').flush('success!');
          });
        });

        it('should resolve relative request URLs without leading slash relative to parent path', async () => {
          ref.injector.get(NgZone).run(() => {
            http.get('testing').subscribe((body) => {
              expect(body).toEqual('success!');
            });
            mock.expectOne('http://localhost:4000/testing').flush('success!');
          });
        });
      });

      describe(`given 'url' is provided in 'INITIAL_CONFIG' with a trailing slash`, () => {
        let mock: HttpTestingController;
        let ref: NgModuleRef<HttpInterceptorExampleModule>;
        let http: HttpClient;

        beforeEach(async () => {
          const platform = platformServer([
            {
              provide: INITIAL_CONFIG,
              useValue: {
                document: '<app></app>',
                url: 'http://localhost:4000/foo/',
              },
            },
          ]);

          ref = await platform.bootstrapModule(HttpInterceptorExampleModule);
          mock = ref.injector.get(HttpTestingController);
          http = ref.injector.get(HttpClient);
        });

        it('should resolve sub-path relative request URLs relative to trailing-slash base URL', async () => {
          ref.injector.get(NgZone).run(() => {
            http.get('testing').subscribe((body) => {
              expect(body).toEqual('success!');
            });
            mock.expectOne('http://localhost:4000/foo/testing').flush('success!');
          });
        });

// Standardizing backslashes to forward slashes ensures the URL constructor resolves it properly.
// This is the same behaviour of new URL
const originalUrl = request.url.trim();
let url = originalUrl.replace(/\\/g, '/');

// If it looks like a relative path, ensure it starts with a single forward slash.
// We check legitimacy on the originalUrl before backslash substitution, ensuring that relative bypass
// attempts (like '/\\' or '\\\\') are treated strictly as paths rather than being converted to protocol-relative targets.
const isAbsolute = URL.canParse(originalUrl);
const isLegitProtocolRelative = originalUrl.startsWith('//') && originalUrl[2] !== '/' && originalUrl[2] !== '\\';

if (!isAbsolute && !isLegitProtocolRelative) {
  if (originalUrl[0] === '/' || originalUrl[0] === '\\') {
    url = '/' + url.replace(/^\/+/, '');
  }
}

const newUrl = new URL(url, baseUrl).toString();