XSS in uber oauth

Hi , I have found that when setting a `redirect_uri` for an application you validate for the presence of `://` in the beginning of the url , but you don't validate for the protocol and you don't block malicious protocols such as `javascript:` pseudo protocol and `data:` URIs. Although the …

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<title>Redirecting...</title>
<h1>Redirecting...</h1>
<p>You should be redirected automatically to target URL: <a …