Merge branch 'security-open-redirect-internalredirect' into 'master'

Use the '\A' and '\z' regex anchors in `InternalRedirect` to mitigate an Open Redirect issue.

Closes #2934

See merge request gitlab/gitlabhq!3466

app/controllers/concerns/internal_redirect.rb

@@ -6,7 +6,7 @@ module InternalRedirect
   def safe_redirect_path(path)
     return unless path
     # Verify that the string starts with a `/` and a known route character.
-    return unless path =~ %r{^/[-\w].*$}
+    return unless path =~ %r{\A/[-\w].*\z}
     uri = URI(path)
     # Ignore anything path of the redirect except for the path, querystring and,

changelogs/unreleased/security-open-redirect-internalredirect.yml

+---
+title: Fixes a Open Redirect issue in `InternalRedirect`.
+merge_request:
+author:
+type: security

spec/controllers/concerns/internal_redirect_spec.rb

@@ -19,7 +19,8 @@ describe InternalRedirect do
       [
         'Hello world',
         '//example.com/hello/world',
-        'https://example.com/hello/world'
+        'https://example.com/hello/world',
+        "not-starting-with-a-slash\n/starting/with/slash"
       ]
     end