Limited Open redirection using SSO-SAML

How it was found

Hello,

Endpoint: https://hackerone.com/users//saml/[email protected]&remember_me=true

Recently, you have patched an open redirection issue which was reported as #171398. I found a bypass of that patch.

Steps to reproduce:

1. Add following in comment/report : https://hackerone.com/users//saml/[email protected]&remember_me=true
2. Click on link.
3. You will redirected on SSO URL without going through External Link Warning page.
4. Done.

PoC : https://hackerone.com/users/saml/[email protected]&remember_me=true (Through external warning page) https://hackerone.com/users//saml/[email protected]&remember_me=true (Without external warning page)

Suggested Fix: Use more stronger regular expression and filtration at this endpoint.

Best regards, Shailesh