This still holds true for unvalidated redirects and forwards and it's the key to how we're going to mitigate this risk.
the code in the snippet earlier on performed no validation of the untrusted data (the query string), whatsoever.