fix: normalize referer before redirect

[fengmk2]

No description provided.

[Copilot]

Pull Request Overview

This PR fixes a security vulnerability related to the "Trailing Double-Slash" attack vector in the back() method. Previously, the code had a special case that directly redirected relative paths without proper validation, which could be exploited using URLs like //evil.com that appear relative but are actually protocol-relative URLs.

Key changes:

• Removed the early return for relative path referrers, forcing all referrers through URL parsing and same-origin validation
• Added test coverage for the security fix to prevent regression
• Updated existing tests to include proper context with host information

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
lib/response.js	Removed unsafe early return for relative path referrers, now all referrers are validated through URL parsing
tests/response/back.test.js	Added security test case for double-slash attack and updated existing tests with proper host context

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.90%. Comparing base (433b20c) to head (846373a).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1908      +/-   ##
==========================================
- Coverage   99.90%   99.90%   -0.01%     
==========================================
  Files           9        9              
  Lines        2066     2060       -6     
==========================================
- Hits         2064     2058       -6     
  Misses          2        2              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.