Use Symfony HTTP utils to generate an always valid redirect response

[bobvandevijver]

No description provided.

[Copilot]

Pull request overview

This PR updates backend bulk operation redirects to use Symfony Security’s HttpUtils for redirect response creation, aiming to produce redirects that are consistently valid in the context of the current request.

Changes:

• Inject Symfony\Component\Security\Http\HttpUtils into BulkOperationsController.
• Replace manual new RedirectResponse($url) redirects with HttpUtils::createRedirectResponse($request, $target) in bulk status and delete actions.

Suppressed comments (1)

src/Controller/Backend/BulkOperationsController.php:91

• Redirecting directly to the Referer header allows an attacker to supply an external URL (open redirect). Also, ?? does not treat an empty Referer as missing. Consider validating/sanitizing the header (same-host or relative only) and falling back when it is empty/invalid.

        return $this->httpUtils->createRedirectResponse(
            $request,
            $request->headers->get('referer') ?? $this->generateUrl('bolt_dashboard')
        );

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.