fix: handle invalid Referrer URLs in back() without crashing

lib/request.js

@@ -96,7 +96,8 @@ module.exports = {
    */
 
   get origin () {
-    return this.req.headers.origin || null
+    if (!this.host) return null
+    return `${this.protocol}://${this.host}`
   },
 
   /**

lib/response.js

@@ -302,7 +302,11 @@ module.exports = {
   redirect (url) {
     if (/^https?:\/\//i.test(url)) {
       // formatting url again avoid security escapes
-      url = new URL(url).toString()
+      try {
+        url = new URL(url).toString()
+      } catch {
+        // invalid URL, encode as-is
+      }
     }
     this.set('Location', encodeUrl(url))
 
@@ -338,11 +342,15 @@ module.exports = {
   back (alt) {
     const referrer = this.ctx.get('Referrer')
     if (referrer) {
-      // referrer is an absolute URL, check if it's the same origin
-      const url = new URL(referrer, this.ctx.href)
-      if (url.host === this.ctx.host) {
-        this.redirect(referrer)
-        return
+      try {
+        // referrer is an absolute URL, check if it's the same origin
+        const url = new URL(referrer, this.ctx.href)
+        if (url.host === this.ctx.host) {
+          this.redirect(referrer)
+          return
+        }
+      } catch {
+        // invalid URL, fall through to alt
       }
     }
 
@@ -657,4 +665,4 @@ module.exports = {
 /* istanbul ignore else */
 if (util.inspect.custom) {
   module.exports[util.inspect.custom] = module.exports.inspect
-}
+}