where a redirect is added by a developer, but has set no validation for the redirect