The'redirect.url.domains.allowed' property somehow doesn't restrict redirection

Issue

• Even when the 'redirect.url.domains.allowed' property is set, some redirects occur.

• Steps to reproduce:
  1) Set the following properties in the portal-ext.properties file.
  redirect.url.security.mode=domain
  redirect.url.domains.allowed=localhost
  2) Start up Liferay
  3) The following URLs are redirected.
  http://localhost:8080/html/common/referer_js.jsp?referer=//google.com/
  http://localhost:8080/html/common/forward_js.jsp?FORWARD_URL=//google.com/
  Expected Behavior: The browser should stay on localhost
  Observed Behavior: The browser is being redirected to google.com

Environment

• Liferay DXP

Resolution

• The observed behavior is a known bug of Liferay DXP and is addressed by LPS-144696

Additional Information

• If the hotfix is required for this issue, please create a support ticket requesting the hotfix by attaching the patch details.
• Installing Fix Packs and Hotfixes on Liferay DXP will guide you to install the Fixpack/Hotfix in your environment.