koa 2.16.0 → 2.16.2

package/lib/application.js

@@ -257,10 +257,9 @@ function respond(ctx) {
   // allow bypassing koa
   if (false === ctx.respond) return;
 
-  const res = ctx.res;
-
-  if (!ctx.writable) return res.end();
+  if (!ctx.writable) return;
 
+  const res = ctx.res;
   let body = ctx.body;
   const code = ctx.status;
 

package/lib/response.js

@@ -240,6 +240,22 @@ module.exports = {
     vary(this.res, field);
   },
 
+  _getBackReferrer() {
+    const referrer = this.ctx.get('Referrer');
+    if (referrer) {
+      // referrer is a relative path
+      if (referrer.startsWith('/')) {
+        return referrer;
+      }
+
+      // referrer is an absolute URL, check if it's the same origin
+      const url = new URL(referrer, this.ctx.href);
+      if (url.host === this.ctx.host) {
+        return referrer;
+      }
+    }
+  },
+
   /**
    * Perform a 302 redirect to `url`.
    *
@@ -261,7 +277,10 @@ module.exports = {
 
   redirect(url, alt) {
     // location
-    if ('back' === url) url = this.ctx.get('Referrer') || alt || '/';
+    if ('back' === url) {
+      url = this._getBackReferrer() || alt || '/';
+    }
+
     if (/^https?:\/\//i.test(url)) {
       // formatting url again avoid security escapes
       url = new URL(url).toString();
@@ -275,7 +294,7 @@ module.exports = {
     if (this.ctx.accepts('html')) {
       url = escape(url);
       this.type = 'text/html; charset=utf-8';
-      this.body = `Redirecting to <a href="${url}">${url}</a>.`;
+      this.body = `Redirecting to ${url}.`;
       return;
     }
 

package/package.json

@@ -1,6 +1,10 @@
 {
   "name": "koa",
-  "version": "2.16.0",
+  "version": "2.16.2",
+  "publishConfig": {
+    "access": "public",
+    "tag": "latest-2"
+  },
   "description": "Koa web app framework",
   "main": "lib/application.js",
   "exports": {