Regression on dest parameter sanitization doesn’t check scheme/websafe destinations

Reddit disclosed a bug submitted by mrzheev: https://hackerone.com/reports/1962951 – Bounty: $500