Ensure location is safe before redirecting in Rails 7.0
When you access a Rails controller from another page, the originating URL is sent to the server as the referrer. In previous versions of Rails, the redirect_back query parameter with allow_other_host set as true could allow a vulnerability for an attacker to override this parameter and force the user to a malicious page.