Unvalidated Redirect Unit Test too Strict

[John Poulin]

The Unvalidated Redirect test is too tight, as it accepts only /dashboard/home. The current code in Railsgoat sets a default path to home_dashboard_index_path (https://github.com/OWASP/railsgoat/blob/master/app/controllers/sessions_controller.rb#L12)

After successfully mitigating the vulnerability, the test still fails with the following error:

  1) unvalidated redirect attack
Tutorial: https://github.com/OWASP/railsgoat/wiki/A10-Unvalidated-Redirects-and-Forwards-(redirect_to)
     Failure/Error: expect(current_url).to eq("/dashboard/home")

       expected: "/dashboard/home"
            got: "http://127.0.0.1:55981/dashboard/home"

I was able to fix this test by modifying it to compare two things. #1) That the current_url starts_with http://127.0.0.1, and #2) that the current path matches /dashboard/home, as seen below:

    expect(current_url).to start_with("http://127.0.0.1")
    expect(current_path).to eq("/dashboard/home")