GitLab: Open redirect

POC: $GITLABINSTANCE = gitlab.com Visit: https://$GITLABINSTANCE/dashboard/todos?page=99999999&host=www.google.com Bug is in Dashboard::TodosController line 10 Likey Same bug in Projects::IssuesController line 32 and other places in the codebase where you redirectto params.merge...