Fix potential panic

https://github.com/XTLS/Xray-core/discussions/6385#discussioncomment-17454120

https://github.com/XTLS/Xray-core/pull/6307#issuecomment-4917498294

Closes https://github.com/XTLS/Xray-core/issues/6410

common/protocol/quic/sniff.go

@@ -143,7 +143,9 @@ func SniffQUIC(b []byte) (*SniffHeader, error) {
 		if err != nil {
 			return nil, err
 		}
-
+		if len(b) < hdrLen+4+block.BlockSize() {
+			return nil, errNotQuic
+		}
 		cache.Clear()
 		mask := cache.Extend(int32(block.BlockSize()))
 		block.Encrypt(mask, b[hdrLen+4:hdrLen+4+len(mask)])

transport/internet/splithttp/config.go

@@ -24,8 +24,11 @@ func (c *Config) GetNormalizedPath() string {
 		path = "/" + path
 	}
 
-	if path[len(path)-1] != '/' {
-		path = path + "/"
+	if c.GetNormalizedSessionPlacement() == PlacementPath ||
+		c.GetNormalizedSeqPlacement() == PlacementPath {
+		if path[len(path)-1] != '/' {
+			path = path + "/"
+		}
 	}
 
 	return path

transport/internet/splithttp/config_test.go

@@ -3,16 +3,77 @@ package splithttp_test
 import (
 	"testing"
 
+	"github.com/stretchr/testify/assert"
 	. "github.com/xtls/xray-core/transport/internet/splithttp"
 )
 
 func Test_GetNormalizedPath(t *testing.T) {
-	c := Config{
-		Path: "/?world",
+	tests := []struct {
+		TestName           string
+		Path               string
+		SessionIDPlacement string
+		SeqPlacement       string
+		Expected           string
+	}{
+		{
+			TestName: "default placement keeps trailing slash",
+			Path:     "/sh",
+			Expected: "/sh/",
+		},
+		{
+			TestName: "query string is stripped",
+			Path:     "/?world",
+			Expected: "/",
+		},
+		{
+			TestName:           "both off path drops trailing slash",
+			Path:               "/stream",
+			SessionIDPlacement: "query",
+			SeqPlacement:       "query",
+			Expected:           "/stream",
+		},
+		{
+			TestName:           "both off path keeps file-like path",
+			Path:               "/stream/filename.extension",
+			SessionIDPlacement: "query",
+			SeqPlacement:       "header",
+			Expected:           "/stream/filename.extension",
+		},
+		{
+			TestName:           "seq in path keeps trailing slash",
+			Path:               "/stream",
+			SessionIDPlacement: "query",
+			Expected:           "/stream/",
+		},
+		{
+			TestName:     "session in path keeps trailing slash",
+			Path:         "/stream",
+			SeqPlacement: "cookie",
+			Expected:     "/stream/",
+		},
+		{
+			TestName:           "existing trailing slash preserved",
+			Path:               "/stream/",
+			SessionIDPlacement: "query",
+			SeqPlacement:       "query",
+			Expected:           "/stream/",
+		},
+		{
+			TestName:           "root unchanged",
+			Path:               "/",
+			SessionIDPlacement: "query",
+			SeqPlacement:       "query",
+			Expected:           "/",
+		},
 	}
-
-	path := c.GetNormalizedPath()
-	if path != "/" {
-		t.Error("Unexpected: ", path)
+	for _, test := range tests {
+		t.Run(test.TestName, func(t *testing.T) {
+			c := Config{
+				Path:               test.Path,
+				SessionIDPlacement: test.SessionIDPlacement,
+				SeqPlacement:       test.SeqPlacement,
+			}
+			assert.Equal(t, test.Expected, c.GetNormalizedPath())
+		})
 	}
 }