test: demonstrate CVE-2025-68470 open redirect vulnerability

Comment out the security fix to show failing tests that demonstrate
the open redirect vulnerability via double-slash pathnames.

The fix is available in PR remix-run#981:
remix-run#981

References:
- CVE-2025-68470
- GHSA-9jcx-v3wj-wh4m

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: boshartduty

modules/LocationUtils.js

@@ -48,19 +48,22 @@ export function createLocation(path, state, key, currentLocation) {
     }
   }
 
+  // COMMENTED OUT FOR BUG REPORT - The following fix addresses CVE-2025-68470
+  // See PR #981 for the complete fix: https://github.com/remix-run/history/pull/981
+  //
   // Security fix: Normalize embedded double-slashes to prevent open redirect vulnerability (CVE-2025-68470)
   // Paths like "//evil.com" could be interpreted as protocol-relative URLs leading to external redirects
-  if (location.pathname && location.pathname.includes('//')) {
-    const oldPathname = location.pathname;
-    location.pathname = location.pathname.replace(/\/\/+/g, '/');
-    warning(
-      false,
-      'Pathnames cannot have embedded double slashes - normalizing ' +
-        oldPathname +
-        ' -> ' +
-        location.pathname
-    );
-  }
+  // if (location.pathname && location.pathname.includes('//')) {
+  //   const oldPathname = location.pathname;
+  //   location.pathname = location.pathname.replace(/\/\/+/g, '/');
+  //   warning(
+  //     false,
+  //     'Pathnames cannot have embedded double slashes - normalizing ' +
+  //       oldPathname +
+  //       ' -> ' +
+  //       location.pathname
+  //   );
+  // }
 
   if (key) location.key = key;