Language: PHP
Label: vulnerable
CWE: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

Code:
    public static function is_absolute_url($url)
    {
        // Strip off the query and fragment parts of the URL before checking
        if (($queryPosition = strpos($url ?? '', '?')) !== false) {
            $url = substr($url ?? '', 0, $queryPosition - 1);
        }
        if (($hashPosition = strpos($url ?? '', '#')) !== false) {
            $url = substr($url ?? '', 0, $hashPosition - 1);
        }
        $colonPosition = strpos($url ?? '', ':');
        $slashPosition = strpos($url ?? '', '/');
        return (
            // Base check for existence of a host on a compliant URL
            parse_url($url ?? '', PHP_URL_HOST)
            // Check for more than one leading slash without a protocol.
            // While not a RFC compliant absolute URL, it is completed to a valid URL by some browsers,
            // and hence a potential security risk. Single leading slashes are not an issue though.
            || preg_match('%^\s*/{2,}%', $url ?? '')
            || (
                // If a colon is found, check if it's part of a valid scheme definition
                // (meaning its not preceded by a slash).
                $colonPosition !== false
                && ($slashPosition === false || $colonPosition < $slashPosition)
            )
        );
    }