  def validate_back_url(back_url)
    if CGI.unescape(back_url).include?('..')
      return false
    end

    begin
      uri = URI.parse(back_url)
    rescue URI::InvalidURIError
      return false
    end

    [:scheme, :host, :port].each do |component|
      if uri.send(component).present? && uri.send(component) != request.send(component)
        return false
      end
      uri.send(:"#{component}=", nil)
    end
    # Always ignore basic user:password in the URL
    uri.userinfo = nil

    path = uri.to_s
    # Ensure that the remaining URL starts with a slash, followed by a
    # non-slash character or the end
    if path !~ %r{\A/([^/]|\z)}
      return false
    end

    if path.match(%r{/(login|account/register)})
      return false
    end

    if relative_url_root.present? && !path.starts_with?(relative_url_root)
      return false
    end

    return path
  end
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.