Zennoxa Shield
Rules / Ruby
SHIELD-RUBY-021

Open redirect via redirect_to with params

mediumRubyCWE-601CVSS 6.1

What it detects

Redirecting to a URL taken from params lets attackers send users to arbitrary sites.

How to fix

Redirect only to validated internal paths or set allow_other_host to false.

Vulnerable — Shield flags thisapp/controllers/sessions_controller.rb
class SessionsController < ApplicationController
  def destroy
    reset_session
    redirect_to params[:return_to]
  end
end
Fixed — scans cleanapp/controllers/sessions_controller.rb
class SessionsController < ApplicationController
  def destroy
    reset_session
    target = params[:return_to].to_s
    safe = target.start_with?("/") && !target.start_with?("//") ? target : root_path
    redirect_to safe
  end
end

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-RUBY-021, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-RUBY-021: Open redirect via redirect_to with params — Zennoxa Shield