Behavior change for Uri::isInternal for URLs without protocol
From Joomla! Documentation
Errors reported[edit]
This release for Joomla 5.1.3 and 4.4.7 changed how Uri::isInternal handles URLs without scheme/protocol. That might lead to redirects, that previously worked, to break after the update.
Versions affected[edit]
General Information
This pertains only to Joomla! version(s): 5.1.3, 4.4.7
What is the cause[edit]
The Uri::isInternal method considered URLs containing a valid hostname but not a scheme ("www.example.org") as internal URLs. This behavior caused multiple attack vectors. With this release, the behavior has been changed. URLs containg a valid hostname will only be considered internal if the scheme ("https://") is provided in the method call and the scheme matches the currently used scheme of the request.
How to fix[edit]
Provide absolute URLs including the scheme/protocol or use relative URLs.