Refactoring possible unprotected redirect. (#3825)

* Refactoring possible unprotected redirect.

* Security refactoring tag_adjustments_controller.rb.

* Security refactoring tag_adjustments_controller.rb.

* Security refactoring articles_controller.rb.

* Security refactoring internal/welcome_controller.rb

* Security refactoring tags_controller.rb.

* Security refactoring comments_controller.rb.

* Security refactoring stories_controller.rb.

app/controllers/articles_controller.rb

@@ -153,7 +153,7 @@ class ArticlesController < ApplicationController
           return
         end
         if params[:destination]
-          redirect_to(params[:destination])
+          redirect_to(URI.parse(params[:destination]).path)
           return
         end
         if params[:article][:video_thumbnail_url]

app/controllers/comments_controller.rb

@@ -107,7 +107,7 @@ class CommentsController < ApplicationController
     authorize @comment
     if @comment.update(permitted_attributes(@comment).merge(edited_at: Time.zone.now))
       Mention.create_all(@comment)
-      redirect_to @comment.path, notice: "Comment was successfully updated."
+      redirect_to URI.parse(@comment.path).path, notice: "Comment was successfully updated."
     else
       @commentable = @comment.commentable
       render :edit
@@ -125,7 +125,7 @@ class CommentsController < ApplicationController
       @comment.deleted = true
       @comment.save!
     end
-    redirect_to @commentable_path, notice: "Comment was successfully deleted."
+    redirect_to URI.parse(@commentable_path).path, notice: "Comment was successfully deleted."
   end
 
   def delete_confirm

app/controllers/internal/welcome_controller.rb

@@ -10,7 +10,7 @@ class Internal::WelcomeController < Internal::ApplicationController
       body_markdown: welcome_thread_content,
       user: User.dev_account,
     )
-    redirect_to welcome_thread.path + "/edit"
+    redirect_to URI.parse(welcome_thread.path).path + "/edit"
   end
 
   private

app/controllers/stories_controller.rb

@@ -54,10 +54,10 @@ class StoriesController < ApplicationController
     potential_username = params[:username].tr("@", "").downcase
     @user = User.find_by("old_username = ? OR old_old_username = ?", potential_username, potential_username)
     if @user&.articles&.find_by(slug: params[:slug])
-      redirect_to "/#{@user.username}/#{params[:slug]}"
+      redirect_to URI.parse("/#{@user.username}/#{params[:slug]}").path
       return
     elsif (@organization = @article.organization)
-      redirect_to "/#{@organization.slug}/#{params[:slug]}"
+      redirect_to URI.parse("/#{@organization.slug}/#{params[:slug]}").path
       return
     end
     not_found

app/controllers/tag_adjustments_controller.rb

@@ -10,7 +10,7 @@ class TagAdjustmentsController < ApplicationController
       reason_for_adjustment: params[:tag_adjustment][:reason_for_adjustment],
     ).create
     @article = Article.find(params[:tag_adjustment][:article_id])
-    redirect_to "#{@article.path}/mod"
+    redirect_to "#{URI.parse(@article.path).path}/mod"
   end
 
   def destroy
@@ -19,6 +19,6 @@ class TagAdjustmentsController < ApplicationController
     tag_adjustment.destroy
     @article = Article.find(tag_adjustment.article_id)
     @article.update!(tag_list: @article.tag_list.add(tag_adjustment.tag_name))
-    redirect_to "#{@article.path}/mod"
+    redirect_to "#{URI.parse(@article.path).path}/mod"
   end
 end

app/controllers/tags_controller.rb

@@ -19,7 +19,7 @@ class TagsController < ApplicationController
     authorize @tag
     if @tag.errors.messages.blank? && @tag.update(tag_params)
       flash[:success] = "Tag successfully updated! 👍 "
-      redirect_to "/t/#{@tag.name}/edit"
+      redirect_to "/t/#{URI.parse(@tag.name).path}/edit"
     else
       flash[:error] = @tag.errors.full_messages
       render :edit