On: Rails Directory Traversal Vulnerability (CVE-2014-0130)

Redirects are hard to get right. Bypass 1 - //host.com. Even if you will use URI library Bypass 2 - ///host.com

Good point, I'll need to modify the redirect to disallow multiple slashes at the beginning.

That should be something like /\A(http(s?):\/\/#{request.host_with_port}|\/\Z|\/[^\/])/

/\host.com