Language: PHP
Label: vulnerable
CWE: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

Code:
    public function testIsSiteUrl()
    {
        $this->assertFalse(Director::is_site_url("http://test.com"));
        $this->assertTrue(Director::is_site_url(Director::absoluteBaseURL()));
        $this->assertFalse(Director::is_site_url("http://test.com?url=" . Director::absoluteBaseURL()));
        $this->assertFalse(Director::is_site_url("http://test.com?url=" . urlencode(Director::absoluteBaseURL() ?? '')));
        $this->assertFalse(Director::is_site_url("//test.com?url=" . Director::absoluteBaseURL()));
        $this->assertFalse(Director::is_site_url('http://google.com\@test.com'));
        $this->assertFalse(Director::is_site_url('http://google.com/@test.com'));
        $this->assertFalse(Director::is_site_url('http://google.com:pass\@test.com'));
        $this->assertFalse(Director::is_site_url('http://google.com:pass/@test.com'));
    }