fix: always add leading slash to routes (#397)

internal/attack/rtsp.go

@@ -166,10 +166,7 @@ func headerValues(header base.Header, name string) base.HeaderValue {
 
 func buildRTSPURL(stream cameradar.Stream, route, username, password string) (*base.URL, string, error) {
 	host := net.JoinHostPort(stream.Address.String(), strconv.Itoa(int(stream.Port)))
-	path := strings.TrimSpace(route)
-	if path != "" && !strings.HasPrefix(path, "/") {
-		path = "/" + path
-	}
+	path := "/" + strings.TrimLeft(strings.TrimSpace(route), "/") // Ensure path starts with a single "/"
 
 	u := &url.URL{
 		Scheme: "rtsp",

internal/attack/rtsp_url_test.go

@@ -0,0 +1,86 @@
+package attack
+
+import (
+	"net/netip"
+	"testing"
+
+	"github.com/Ullaakut/cameradar/v6"
+	"github.com/stretchr/testify/require"
+)
+
+func TestBuildRTSPURL(t *testing.T) {
+	stream := cameradar.Stream{
+		Address: netip.MustParseAddr("192.168.0.10"),
+		Port:    554,
+	}
+
+	tests := []struct {
+		name     string
+		route    string
+		username string
+		password string
+		wantURL  string
+	}{
+		{
+			name:    "empty route",
+			wantURL: "rtsp://192.168.0.10:554/",
+		},
+		{
+			name:    "root route",
+			route:   "/",
+			wantURL: "rtsp://192.168.0.10:554/",
+		},
+		{
+			name:    "multiple leading slashes",
+			route:   "////",
+			wantURL: "rtsp://192.168.0.10:554/",
+		},
+		{
+			name:    "route with no leading slash",
+			route:   "stream",
+			wantURL: "rtsp://192.168.0.10:554/stream",
+		},
+		{
+			name:    "route with leading slash",
+			route:   "/stream",
+			wantURL: "rtsp://192.168.0.10:554/stream",
+		},
+		{
+			name:    "route with trailing slash",
+			route:   "stream/",
+			wantURL: "rtsp://192.168.0.10:554/stream/",
+		},
+		{
+			name:    "route with spaces",
+			route:   "  /stream  ",
+			wantURL: "rtsp://192.168.0.10:554/stream",
+		},
+		{
+			name:     "username and password",
+			route:    "stream",
+			username: "admin",
+			password: "admin123",
+			wantURL:  "rtsp://admin:admin123@192.168.0.10:554/stream",
+		},
+		{
+			name:     "empty username with password",
+			route:    "stream",
+			password: "pass",
+			wantURL:  "rtsp://:pass@192.168.0.10:554/stream",
+		},
+		{
+			name:     "username only",
+			route:    "stream",
+			username: "user",
+			wantURL:  "rtsp://user:@192.168.0.10:554/stream",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			_, gotURL, err := buildRTSPURL(stream, test.route, test.username, test.password)
+			require.NoError(t, err)
+			require.Equal(t, test.wantURL, gotURL)
+		})
+	}
+}

internal/output/m3u.go

@@ -112,10 +112,7 @@ func formatStreamLabel(stream cameradar.Stream) string {
 }
 
 func formatRTSPURL(stream cameradar.Stream) string {
-	path := strings.TrimSpace(stream.Route())
-	if path != "" && !strings.HasPrefix(path, "/") {
-		path = "/" + path
-	}
+	path := "/" + strings.TrimLeft(strings.TrimSpace(stream.Route()), "/")
 
 	credentials := ""
 	if stream.CredentialsFound && (stream.Username != "" || stream.Password != "") {

internal/ui/summary.go

@@ -119,10 +119,7 @@ func formatStream(stream cameradar.Stream) string {
 }
 
 func formatRTSPURL(stream cameradar.Stream) string {
-	path := stream.Route()
-	if path != "" && !strings.HasPrefix(path, "/") {
-		path = "/" + path
-	}
+	path := "/" + strings.TrimLeft(strings.TrimSpace(stream.Route()), "/")
 
 	credentials := ""
 	if stream.Username != "" || stream.Password != "" {