Ruby on Rails: redirect_to(["string"]) remote code execution

For example, redirect_to(params[:user_input]) with a URL of ?user_input[]=something calls the method something_url and tries to redirect the return value of the method. If this call is on an unauthenticated route, it would allow an external user to test if a route name exists by determining if the app 500s (the method does not exist) or successfully redirects.

Impact

Any public method defined on a controller ending with _url could be remotely executed.