fix: harden redirect validation and bounded reads

fix: harden redirect validation and bounded reads #5921