DefaultRedirectStrategy vulnerable to open redirect phishing attacks using protocol relative paths (double slash)

Summary

If a org.springframework.security.web.DefaultRedirectStrategy is configured to be context relative, it does not prevent against protocol relative URLs. The configuration would suggest protection against phishing attacks, but this is not the case if it can take you to another domain.

This was mentioned here with a suggested solution by Wojciech Gizynski. If worried as to the suggestion, protection against only use cases that start with // might be lower risk:
https://github.com/spring-projects/spring-security/issues/2405#issuecomment-180600671

Actual Behavior

A query parameter such as ?redirect=//phishing.com will redirect you to another domain despite the strategy being configured as context relative.

Expected Behavior

A query parameter such as ?redirect=//phishing.com will redirect you to a context relative location if the strategy has been configured as context relative.

Configuration

  <bean id="simpleUrlAuthenticationSuccessHandler"
        class="org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler">
    <property name="targetUrlParameter" value="continue"/>
    <property name="defaultTargetUrl" value="/"/>
    <property name="redirectStrategy">
      <bean class="org.springframework.security.web.DefaultRedirectStrategy">
        <property name="contextRelative" value="true"/>
      </bean>
    </property>
  </bean>

Version

4.2.1.RELEASE

Start by reading org.springframework.security.web.DefaultRedirectStrategy, focusing on how the contextRelative setting handles targets beginning with //. Reproduce the configured redirect=//phishing.com case and verify that the completed behavior keeps the redirect within the application context rather than treating it as another domain.