Backend: Use strings.SplitSeq for split-and-iterate loops #5599

Replace strings.Split with the lazy strings.SplitSeq iterator (Go 1.23+)
in loops that only range over the tokens, avoiding the intermediate
slice allocation. The yielded substrings are identical to Split, so
behavior is unchanged. Applies the suggestion from #5599 to its three
sites (CIDR parsing, WebDAV hidden-path, overlay path checks) and
extends it to two more split-and-iterate loops in the server compression
negotiator and MCP config-options builder for consistency. The slice
returning splitPath helper is intentionally left on strings.Split.

internal/mcp/data.go

@@ -79,7 +79,7 @@ func buildConfigOptions() []ConfigOption {
 	sectionStarts := make(map[string]string)
 
 	for _, section := range config.OptionsReportSections {
-		for _, key := range strings.Split(section.Start, ", ") {
+		for key := range strings.SplitSeq(section.Start, ", ") {
 			sectionStarts[key] = section.Title
 		}
 	}

internal/server/compress_negotiate.go

@@ -52,7 +52,7 @@ func parseAcceptEncoding(header string) map[string]float64 {
 	if header == "" {
 		return result
 	}
-	for _, part := range strings.Split(header, ",") {
+	for part := range strings.SplitSeq(header, ",") {
 		part = strings.TrimSpace(part)
 		if part == "" {
 			continue
@@ -61,7 +61,7 @@ func parseAcceptEncoding(header string) map[string]float64 {
 		q := 1.0
 		if i := strings.IndexByte(part, ';'); i >= 0 {
 			token = strings.TrimSpace(part[:i])
-			for _, p := range strings.Split(part[i+1:], ";") {
+			for p := range strings.SplitSeq(part[i+1:], ";") {
 				p = strings.TrimSpace(p)
 				if !strings.HasPrefix(strings.ToLower(p), "q=") {
 					continue

internal/service/cidr.go

@@ -21,7 +21,7 @@ func ParseCIDRs(raw string) (result []*net.IPNet, err error) {
 		return result, nil
 	}
 
-	for _, token := range strings.Split(raw, ",") {
+	for token := range strings.SplitSeq(raw, ",") {
 		token = strings.TrimSpace(token)
 
 		if token == "" {

internal/service/webdav/path.go

@@ -7,7 +7,7 @@ import (
 
 // isHiddenPath reports whether any segment of a WebDAV path starts with a dot.
 func isHiddenPath(dir string) bool {
-	for _, segment := range strings.Split(trimPath(dir), "/") {
+	for segment := range strings.SplitSeq(trimPath(dir), "/") {
 		if strings.HasPrefix(segment, ".") {
 			return true
 		}

pkg/http/security/web_overlay.go

@@ -77,7 +77,7 @@ func OverlayHasAmbiguousPath(requestPath, escapedPath string) bool {
 	}
 
 	if relPath := strings.Trim(cleanPath, "/"); relPath != "" {
-		for _, segment := range strings.Split(relPath, "/") {
+		for segment := range strings.SplitSeq(relPath, "/") {
 			if segment == "" || segment == "." || segment == ".." || fs.FileNameHidden(segment) {
 				return true
 			}
@@ -120,9 +120,9 @@ func OverlayPathBlocked(webPath string) bool {
 		return false
 	}
 
-	segments := strings.Split(relPath, "/")
+	segments := strings.SplitSeq(relPath, "/")
 
-	for _, segment := range segments {
+	for segment := range segments {
 		if segment == "" || fs.FileNameHidden(segment) {
 			return true
 		}