Open Redirect via Untrusted URLs

Description

Detects user input flowing into redirect functions without URL validation.

What Shoulder detects

Untrusted input from {source} reaches redirect function at {sink}.
This allows an attacker to redirect users to malicious websites in phishing attacks.

How to fix

Validate redirect URLs against an allowlist or ensure they are relative paths.

```javascript
const ALLOWED = ['/home', '/dashboard', '/profile'];
if (ALLOWED.includes(url) || url.startsWith('/')) {
  res.redirect(url);
}
```

Learn more: https://shoulder.dev/learn/javascript/cwe-601/open-redirect