When a malformed Host header containing @ symbol (e.g., "evil.com:fake@legitimate.com")
is received, use URL parser to correctly extract the actual host portion instead of
naively splitting by colon which would return attacker-controlled value.
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
55ab9bab04