InvalidArgumentException: The user-entered string 'portal' must begin with a '/', '?', or '#'. in Drupal\Core\Url::fromUserInput()

Had same issue, this works for me. I would say RTBC

I had same issue where the redirect to legal_confirm contains the url argument "destination=something", this fixes the issue

If the current patch is applied we end up with 2 issues.

#1 The default redirect to /user/ID is broken. You can't use "//user/ID" as a path. That's why the test is failing.

$redirect = '/user/' . $values['uid'];
...
$form_state->setRedirectUrl(Url::fromUserInput('/' . $redirect));

#2 Url destination parameters can come with or without a leading forward slash. Both need to be taken into account.

I'm attaching a patch that mitigates both issues. It also generates the user URL in better way, URL hardcoding should be avoided.

+++ b/src/Form/LegalLogin.php
@@ -216,14 +217,23 @@ public function submitForm(array &$form, FormStateInterface $form_state) {
+      $destination_path = $_GET['destination'];

Let's use the redirect.destination service, since we're touching this line.

Fixed in this patch. I also removed some unused class properties: $database, $moduleHandler, and $languageManager.

Fixing the last patch

Added a fix to prevent the from from redirecting to itself.

@alecsmrekar please don't use patches on an issue where a MR was used. Please incorporate the (only issue related!!) changes into the MR so we can see the interdiff. All other changes should go into separate issues please.

This no longer appears to be an issue. As mentioned above, the initial patch supplied here: https://git.drupalcode.org/project/legal/-/merge_requests/3.patch actually breaks the redirect altogether (in the 3.x branch at least). After I removed this patch I attempted to recreate the initial bug reported in this issue but cannot. I suspect the problem was fixed elsewhere and this issue merely needs to be closed.

I have not tried any of the patches, however, I can confirm that this issue is still present on 3.0.1

So do we need a new stable release or is this also still happening in 3.0.x @frob?

I am unable to test the new version at the moment. However, the test is pretty simple. If you visit `/user/login?destination=internet` then it should break with the OP's error.

To fix this ourselves we patched the `public/modules/contrib/legal/src/Form/LegalLogin.php` file to ensure the destination is valid. It looks like you where leaning toward a solution which involved the redirection service so I didn't submit my patch.

Replace

      $redirect = $_GET['destination'];

with

      $destination_path = $_GET['destination'];
      if (strpos($destination_path, '/') !== 0) {
        $destination_path = '/' . $destination_path;
      }
      $redirect = $destination_path;