GitlabSecurity-RedirectToParamsUpdate.md

Pattern: Use of redirect_to(params.update())

Issue: -

Description

Check for use of redirect_to(params.update()). Passing user params to the redirect_to method provides an open redirect.

Examples

# bad
redirect_to(params.update(action:'main'))

# good
redirect_to(whitelist(params))

Further Reading

• RuboCop - Airbnb/RedirectToParamsUpdate