koa 2.16.1 → 2.16.2

package/lib/response.js

@@ -240,6 +240,22 @@ module.exports = {
     vary(this.res, field);
   },
 
+  _getBackReferrer() {
+    const referrer = this.ctx.get('Referrer');
+    if (referrer) {
+      // referrer is a relative path
+      if (referrer.startsWith('/')) {
+        return referrer;
+      }
+
+      // referrer is an absolute URL, check if it's the same origin
+      const url = new URL(referrer, this.ctx.href);
+      if (url.host === this.ctx.host) {
+        return referrer;
+      }
+    }
+  },
+
   /**
    * Perform a 302 redirect to `url`.
    *
@@ -261,7 +277,10 @@ module.exports = {
 
   redirect(url, alt) {
     // location
-    if ('back' === url) url = this.ctx.get('Referrer') || alt || '/';
+    if ('back' === url) {
+      url = this._getBackReferrer() || alt || '/';
+    }
+
     if (/^https?:\/\//i.test(url)) {
       // formatting url again avoid security escapes
       url = new URL(url).toString();

package/package.json

@@ -1,6 +1,10 @@
 {
   "name": "koa",
-  "version": "2.16.1",
+  "version": "2.16.2",
+  "publishConfig": {
+    "access": "public",
+    "tag": "latest-2"
+  },
   "description": "Koa web app framework",
   "main": "lib/application.js",
   "exports": {