berk/tr8n — pull request #32 by plerohellec (2012-04-05 23:08:56+00:00)
Title: There could be a redirect vulnerability here or even XSS. For example if...

... source url is set to "%64%61%74%61%3a%74%65%78%74%2f%68%74%6d%6c%3b%62%61%73%65%36%34%2c%50%48%4e%6a%63%6d%6c%77%64%44%35%68%62%47%56%79%64%43%67%6e%57%46%4e%54%4a%79%6b%38%4c%33%4e%6a%63%6d%6c%77%64%44%34%4b", javascript could get executed.

Prevent that by making sure protocol and hostname in the redirected url match the current protocol and host.