@@ -11,12 +11,13 @@ export default function trailingSlashes(req: ExtendedRequest, res: Response, nex
       while (pathname.endsWith('/')) {
         pathname = pathname.slice(0, pathname.length - 1)
       }
-      let url = pathname
+      // An empty Location resolves to the same URL, so a path of only slashes goes to the homepage.
+      if (!pathname) pathname = '/'
+      // Collapse repeated slashes in the path only, because query values can contain //.
+      let url = pathname.replace(/\/+/g, '/')
       if (split.length) {
         url += `?${split.join('?')}`
       }
-      // Collapse repeated slashes so the redirect points to one canonical URL.
-      url = url.replace(/\/+/g, '/')
       defaultCacheControl(res)
       return res.safeRedirect(301, url)
     }
 
@@ -0,0 +1,69 @@
+import { describe, expect, test } from 'vitest'
+import type { Response } from 'express'
+
+import trailingSlashes from '@/frame/middleware/trailing-slashes'
+import { safeRedirectUrl } from '@/frame/middleware/safe-redirect'
+import type { ExtendedRequest } from '@/types'
+
+function run(url: string) {
+  const req = { method: 'GET', url } as ExtendedRequest
+  const headers: Record<string, string> = {}
+  const result: { status?: number; location?: string; nextCalled: boolean } = {
+    nextCalled: false,
+  }
+  const res = {
+    set(key: string, value: string) {
+      headers[key.toLowerCase()] = value
+      return this
+    },
+    hasHeader(key: string) {
+      return key.toLowerCase() in headers
+    },
+    safeRedirect(status: number, location: string) {
+      result.status = status
+      result.location = safeRedirectUrl(location)
+    },
+  } as unknown as Response
+  trailingSlashes(req, res, () => {
+    result.nextCalled = true
+  })
+  return { ...result, headers }
+}
+
+describe('trailingSlashes middleware', () => {
+  test('redirects a path of only slashes to the homepage', () => {
+    const result = run('//')
+    expect(result.status).toBe(301)
+    expect(result.location).toBe('/')
+    expect(result.headers['cache-control']).toMatch(/max-age=\d+/)
+  })
+
+  test('keeps the query string when redirecting a path of only slashes', () => {
+    const result = run('//?foo=1')
+    expect(result.status).toBe(301)
+    expect(result.location).toBe('/?foo=1')
+  })
+
+  test('keeps double slashes inside query values', () => {
+    expect(run('//?next=https://github.com').location).toBe('/?next=https://github.com')
+    expect(run('/en//search/?query=a//b').location).toBe('/en/search?query=a//b')
+  })
+
+  test('removes a trailing slash and keeps the query string', () => {
+    const result = run('/foo/?a=1')
+    expect(result.status).toBe(301)
+    expect(result.location).toBe('/foo?a=1')
+  })
+
+  test('removes trailing double slashes', () => {
+    const result = run('/en//')
+    expect(result.status).toBe(301)
+    expect(result.location).toBe('/en')
+  })
+
+  test('calls next for the homepage', () => {
+    const result = run('/')
+    expect(result.nextCalled).toBe(true)
+    expect(result.status).toBeUndefined()
+  })
+})
@@ -27,7 +27,11 @@ export default function handleRedirects(req: ExtendedRequest, res: Response, nex
 
   // Collapse duplicate slashes before patterns.assetPaths, so //example.com cannot bypass handling.
   if (req.path.includes('//')) {
-    return res.safeRedirect(301, req.path.replace(/\/+/g, '/'))
+    // Take only the query from req.url, because an absolute-form req.url also holds the scheme and host.
+    const queryIndex = req.url.indexOf('?')
+    const query = queryIndex === -1 ? '' : req.url.slice(queryIndex)
+    defaultCacheControl(res)
+    return res.safeRedirect(301, req.path.replace(/\/+/g, '/') + query)
   }
 
   if (patterns.assetPaths.test(req.path)) return next()
 
@@ -456,6 +456,13 @@ describe('redirects', () => {
       expect(res.headers.location).toBe(`/en/rest`)
     })
 
+    test('double-slash in the URL keeps the query string', async () => {
+      const res = await get(`/en//search?query=git`)
+      expect(res.statusCode).toBe(301)
+      expect(res.headers.location).toBe(`/en/search?query=git`)
+      expect(res.headers['cache-control']).toMatch(/max-age=\d+/)
+    })
+
     test('double-slash trailing in the URL', async () => {
       const res = await get(`/en//`)
       expect(res.statusCode).toBe(301)
 
@@ -2,6 +2,7 @@ import { describe, expect, test } from 'vitest'
 import type { NextFunction, Response } from 'express'
 
 import handleRedirects from '@/redirects/middleware/handle-redirects'
+import { safeRedirectUrl } from '@/frame/middleware/safe-redirect'
 import type { Context, ExtendedRequest } from '@/types'
 
 type TestResponse = {
@@ -100,3 +101,43 @@ describe('handleRedirects with :// in the query string', () => {
     expect(result.location).toBe('https://example.com/docs?ref=abc')
   })
 })
+
+function runWithPath(url: string, path: string) {
+  const req = { method: 'GET', url, path, context: {} } as unknown as ExtendedRequest
+  const headers: Record<string, string> = {}
+  const result: { status?: number; location?: string } = {}
+  const res = {
+    set(key: string, value: string) {
+      headers[key.toLowerCase()] = value
+      return this
+    },
+    hasHeader(key: string) {
+      return key.toLowerCase() in headers
+    },
+    safeRedirect(status: number, location: string) {
+      result.status = status
+      result.location = safeRedirectUrl(location)
+    },
+  } as unknown as Response
+  handleRedirects(req, res, () => {})
+  return { ...result, headers }
+}
+
+describe('handleRedirects double slashes', () => {
+  test('collapses slashes in the path and keeps the query string', () => {
+    const result = runWithPath('/en//search?query=git', '/en//search')
+    expect(result.status).toBe(301)
+    expect(result.location).toBe('/en/search?query=git')
+    expect(result.headers['cache-control']).toMatch(/max-age=\d+/)
+  })
+
+  test('keeps double slashes inside query values', () => {
+    const result = runWithPath('/en//search?query=a//b', '/en//search')
+    expect(result.location).toBe('/en/search?query=a//b')
+  })
+
+  test('stays origin-relative for an absolute-form request target', () => {
+    const result = runWithPath('https://docs.github.com/en//search?query=git', '/en//search')
+    expect(result.location).toBe('/en/search?query=git')
+  })
+})
Original file line number	Diff line number	Diff line change
`@@ -11,12 +11,13 @@ export default function trailingSlashes(req: ExtendedRequest, res: Response, nex`
`11`	`11`	`while (pathname.endsWith('/')) {`
`12`	`12`	`pathname = pathname.slice(0, pathname.length - 1)`
`13`	`13`	`}`
`14`		`- let url = pathname`
	`14`	`+ // An empty Location resolves to the same URL, so a path of only slashes goes to the homepage.`
	`15`	`+ if (!pathname) pathname = '/'`
	`16`	`+ // Collapse repeated slashes in the path only, because query values can contain //.`
	`17`	`+ let url = pathname.replace(/\/+/g, '/')`
`15`	`18`	`if (split.length) {`
`16`	`19`	url += `?${split.join('?')}`
`17`	`20`	`}`
`18`		`- // Collapse repeated slashes so the redirect points to one canonical URL.`
`19`		`- url = url.replace(/\/+/g, '/')`
`20`	`21`	`defaultCacheControl(res)`
`21`	`22`	`return res.safeRedirect(301, url)`
`22`	`23`	`}`