CVE-2025-9072: Mattermost Open Redirect vulnerability

The analysis of the provided commits clearly indicates that the vulnerability is located in the fullyQualifiedRedirectURL function within the server/channels/web/oauth.go file. All three provided patches modify this exact function to introduce stricter validation for the redirect URL. The vulnerability description mentions a failure to validate the redirect_to parameter, and this function is where the targetURL (derived from that parameter) is processed to create a full URL. The patch replaces a simple and flawed URL parsing and concatenation logic with a robust validation mechanism. This new mechanism checks that the scheme and host of the target URL match the site's URL and also prevents path traversal attacks by cleaning and comparing URL paths. Therefore, the fullyQualifiedRedirectURL function is the exact location of the open redirect vulnerability. During exploitation, a call to this function with a malicious targetURL would be present in the runtime profile.