Language: JavaScript
Label: safe
CWE: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

Code:
const url = (location, omitQuery = false) => {
  const query = Query.parse(location.search)

  const next = query.n || appRoot

  if (omitQuery) {
    return next.split('?')[0]
  }

  // Only allow relative redirects to prevent open redirects.
  if (!next.startsWith('/') || next.startsWith('//')) {
    return appRoot
  }

  return next
}