Don't let the URL choose
The fix is to stop treating the destination as free text:
Tip: Redirect only to a fixed allow-list of paths or to relative paths you build yourself; if you must accept a target, validate it resolves to your own host and reject absolute URLs and
//hostforms. When in doubt, show an interstitial “you are leaving this site” page instead of redirecting silently.