Sanitize the entire geo_return_to_after_login url

ee/app/controllers/ee/sessions_controller.rb

@@ -41,7 +41,7 @@ module EE
     end
 
     def geo_return_to_after_login
-      ::Gitlab::Utils.append_path(root_url, sanitize_redirect(session[:user_return_to].to_s))
+      sanitize_redirect(::Gitlab::Utils.append_path(root_url, session[:user_return_to].to_s))
     end
 
     def geo_return_to_after_logout

ee/spec/controllers/ee/sessions_controller_spec.rb

@@ -28,7 +28,7 @@ describe SessionsController do
 
           expect(response).to have_gitlab_http_status(302)
           expect(response).to redirect_to %r(\A#{primary_node.url}oauth/geo/auth)
-          expect(redirect_params['state'].first).to end_with(':/')
+          expect(redirect_params['state'].first).to end_with(':')
         end
       end