Attacker can smuggle a malicious domain in a URI object.

In many common URI-validation scenarios, the target system will likely parse a user provided URI, and then check the host against some internal validation criteria, eg, that it's a host owned by that system. Seeing a blank hostname will often cause the system to assume that the link only contains a …

user_provided_redirect_uri = "http:////malware.com/real/path"
evil_uri = URI.parse(user_provided_redirect_uri)
evil_uri.host          # => nil
evil_uri.to_s          # => "http://malware.com/real/path"