File: vendor/wp-coding-standards/wpcs/WordPress/Docs/Security/SafeRedirectStandard.xml

<?xml version="1.0"?>
<documentation xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:noNamespaceSchemaLocation="https://phpcsstandards.github.io/PHPCSDevTools/phpcsdocs.xsd"
    title="Safe Redirect"
    >
    <standard>
    <![CDATA[
    wp_safe_redirect() should be used whenever possible to prevent open redirect vulnerabilities. One of the main uses of an open redirect vulnerability is to make phishing attacks more credible. In this case the user sees your (trusted) domain and might get redirected to an attacker controlled website aimed at stealing private information.
    ]]>
    </standard>
    <code_comparison>
        <code title="Valid: Redirect can only go to allowed domains.">
        <![CDATA[
<em>wp_safe_redirect</em>( $location );
        ]]>
        </code>
        <code title="Invalid: Unsafe redirect, can be abused.">
        <![CDATA[
<em>wp_redirect</em>( $location );
        ]]>
        </code>
    </code_comparison>
</documentation>