diff --git includes/common.inc includes/common.inc
index 7cbb1d6..40c3c7c 100644
--- includes/common.inc
+++ includes/common.inc
@@ -659,7 +659,7 @@ function drupal_encode_path($path) {
  */
 function drupal_goto($path = '', array $options = array(), $http_response_code = 302) {
   // A destination in $_GET always overrides the function arguments.
-  if (isset($_GET['destination'])) {
+  if (isset($_GET['destination']) && !url_is_external($_GET['destination'])) {
     $destination = drupal_parse_url(urldecode($_GET['destination']));
     $path = $destination['path'];
     $options['query'] = $destination['query'];
diff --git modules/simpletest/tests/common.test modules/simpletest/tests/common.test
index 8c27756..24053df 100644
--- modules/simpletest/tests/common.test
+++ modules/simpletest/tests/common.test
@@ -200,8 +200,13 @@ class CommonURLUnitTest extends DrupalWebTestCase {
     // Non-clean URLs #3: URL generated by url() on non-Apache webserver.
     $url = 'index.php?q=foo/bar&bar=baz#foo';
     $this->assertEqual(drupal_parse_url($url), $result, t('Relative URL on non-Apache webserver with clean URLs disabled parsed correctly.'));
-  }
 
+    // Test that drupal_parse_url doesn't expose the hole discussed at
+    // http://drupal.org/node/733028
+    $parts = drupal_parse_url('forged:http://cwe.mitre.org/data/definitions/601.html');
+    $this->assertFalse(valid_url($parts['path'], TRUE), t('drupal_parse_url() correctly parsed a forged URL.'));
+  }
+  
   /**
    * Test url() with/without query, with/without fragment, absolute on/off and
    * assert all that works when clean URLs are on and off.