fix: harden bounded reads and redirect validation (#3671)

fix: harden bounded reads and redirect validation (#3671) #5922