fix: normalize referer before redirect (#1909)

pick from #1908

Author: fengmk2

__tests__/response/redirect.js

@@ -47,46 +47,47 @@ describe('ctx.redirect(url)', () => {
 
   describe('with "back"', () => {
     it('should redirect to Referrer', () => {
-      const ctx = context();
+      const ctx = context({ url: '/', headers: { host: 'example.com' } });
       ctx.req.headers.referrer = '/login';
       ctx.redirect('back');
       assert.strictEqual(ctx.response.header.location, '/login');
     });
 
-    it('should redirect to Referer', () => {
-      const ctx = context();
-      ctx.req.headers.referer = '/login';
-      ctx.redirect('back');
-      assert.strictEqual(ctx.response.header.location, '/login');
-    });
-
     it('should default to alt', () => {
-      const ctx = context();
+      const ctx = context({ url: '/', headers: { host: 'example.com' } });
       ctx.redirect('back', '/index.html');
       assert.strictEqual(ctx.response.header.location, '/index.html');
     });
 
     it('should default redirect to /', () => {
-      const ctx = context();
+      const ctx = context({ url: '/', headers: { host: 'example.com' } });
       ctx.redirect('back');
       assert.strictEqual(ctx.response.header.location, '/');
     });
 
     it('should redirect to the same origin referrer', () => {
-      const ctx = context();
-      ctx.req.headers.host = 'example.com';
+      const ctx = context({ url: '/', headers: { host: 'example.com' } });
       ctx.req.headers.referrer = 'https://example.com/login';
       ctx.redirect('back');
       assert.strictEqual(ctx.response.header.location, 'https://example.com/login');
     });
 
     it('should redirect to root if the same origin referrer is not present', () => {
-      const ctx = context();
-      ctx.req.headers.host = 'example.com';
+      const ctx = context({ url: '/', headers: { host: 'example.com' } });
       ctx.req.headers.referrer = 'https://other.com/login';
       ctx.redirect('back');
       assert.strictEqual(ctx.response.header.location, '/');
     });
+
+    it('should fix Trailing Double-Slash security issue', () => {
+      const ctx = context({ url: '/', headers: { host: 'example.com' } });
+      ctx.req.headers.referrer = '//evil.com/login/';
+      ctx.redirect('back');
+      assert.equal(ctx.response.header.location, '/');
+
+      ctx.redirect('back', '/home');
+      assert.equal(ctx.response.header.location, '/home');
+    });
   });
 
   describe('when html is accepted', () => {

lib/response.js

@@ -243,11 +243,6 @@ module.exports = {
   _getBackReferrer() {
     const referrer = this.ctx.get('Referrer');
     if (referrer) {
-      // referrer is a relative path
-      if (referrer.startsWith('/')) {
-        return referrer;
-      }
-
       // referrer is an absolute URL, check if it's the same origin
       const url = new URL(referrer, this.ctx.href);
       if (url.host === this.ctx.host) {