Add latest changes from gitlab-org/security/gitlab@14-7-stable-ee

1 files changed, 10 insertions, 0 deletions

diff --git a/app/controllers/jira_connect/users_controller.rb b/app/controllers/jira_connect/users_controller.rb
index 569dc42fed3..a37c68de299 100644
--- a/app/controllers/jira_connect/users_controller.rb
+++ b/app/controllers/jira_connect/users_controller.rb
@@ -5,7 +5,17 @@ class JiraConnect::UsersController < ApplicationController
 
   layout 'signup_onboarding'
 
+  before_action :verify_return_to_url, only: [:show]
+
   def show
     @jira_app_link = params.delete(:return_to)
   end
+
+  private
+
+  def verify_return_to_url
+    return unless params[:return_to].present?
+
+    params.delete(:return_to) unless Integrations::Jira.valid_jira_cloud_url?(params[:return_to])
+  end
 end