==== The trap of ``String.startsWith`` and equivalents

When validating untrusted URLs by checking if they start with a trusted scheme and authority pair `scheme://authority`, **ensure that the validation string contains a path separator character (i.e., a `/`) as the last character**.

When this character is not present, attackers may be able to register a specific domain name that both passes validation and is controlled by them.

For example, when validating the `\https://example.com` domain, suppose an attacker owns the `\https://example.evil` domain. If the prefix-based validation is implemented incorrectly, they could create a `\https://example.com.example.evil` subdomain to abuse the broken validation.

The practice of taking over domains that maliciously look like existing domains is widespread and is called https://en.wikipedia.org/wiki/Cybersquatting[cybersquatting].
