# [CRUCIBLE-SEED]
# category: open_redirect
# severity: medium
# language: ruby
# expected: Regex-based redirect validation bypassable with CRLF or subdomain trick

class RedirectController < ApplicationController
  SAFE_DOMAIN = 'example.com'

  def go
    target = params[:to]
    if target =~ /example\.com/
      redirect_to target, allow_other_host: true
    else
      redirect_to root_path
    end
  end

  def external
    url     = params[:url]
    trusted = ['example.com', 'partner.com']
    host    = URI.parse(url).host rescue ''
    if trusted.include?(host)
      redirect_to url, allow_other_host: true
    end
  end
end