Open redirect in user_saml via RelayState parameter in Nextcloud User Saml

An attacker can craft a link to a Nextcloud server's SAML login endpoint that includes an `originalUrl` query parameter pointing to an attacker-controlled third-party server [ref_id=1]. When a victim follows this link and completes the authentication flow, the application redirects them to the untrusted URL, resulting in an open redirect vulnerability. No special privileges or network position beyond crafting a hyperlink is required.

The `login()` method in `SAMLController` (likely `lib/Controller/SAMLController.php` in the `user_saml` app) reads the `originalUrl` parameter from the HTTP request without validating it. The patch [ref_id=1] adds a check using `ITrustedDomainHelper::isTrustedUrl()` to reject untrusted URLs before using them as redirect targets or return URLs.

The patch [ref_id=1] introduces an `ITrustedDomainHelper` dependency and calls `isTrustedUrl()` on the `originalUrl` parameter. If the URL is not trusted, it is replaced with an empty string, so the subsequent redirect logic falls back to a safe default route (e.g., the login route itself or the app's root URL). This ensures that only URLs belonging to trusted domains are accepted as redirect targets, closing the open redirection vector.