ruby/ruby — pull request #437 by homakov (2013-11-08 15:34:23+00:00)
Title: Triple slash

So,
```
1.9.3p194 :022 > URI.parse('///x.com').host
=> nil
1.9.3p194 :023 > URI.parse('///x.com').path
=> "/x.com"
```
and this is completely valid.

But browsers don't think so. They *fix* ///x.com to //x.com and load scheme-relative URL, e.g. https://x.com.
That opens a possible open redirect vulnerability on every redirect validation that relies on .host checks and doesn't prepend the hostname (responds with Location: ///relativepath).
I mean such code is vulnerable.
```
url = URI.parse(params[:to])
if !url.host or url.host == 'samesite.com'
redirect params[:to]
end```