The patch modifies the redirect method in ActionController::Response to add CRLF sanitization. The original code directly used user-controlled 'to_url' parameter for both Location header and response body without filtering. This would appear in runtime traces when processing redirects, as it's the core method handling HTTP redirection logic. The vulnerability manifests here because attackers could inject CRLF sequences to create malicious HTTP headers.