@@ -365,6 +365,35 @@ describe("Url utils tests", () => {
365365 } ) ;
366366 } ) ;
367367
368+ describe ( "getPreviousPageUrl tests" , ( ) => {
369+
370+ test ( "returns correct previous page from request headers" , ( ) => {
371+ req [ "rawHeaders" ] = [ "Referer" , `http://host-name${ config . WHO_IS_MAKING_FILING_URL } ` ] ;
372+
373+ const previousPage = urlUtils . getPreviousPageUrl ( req , config . REGISTER_AN_OVERSEAS_ENTITY_URL ) ;
374+
375+ // Check that the "http://host-name" absolute URL prefix has been stripped off when setting the previousPage URL
376+ expect ( previousPage ) . toEqual ( config . WHO_IS_MAKING_FILING_URL ) ;
377+ } ) ;
378+
379+ test ( "does not return a potentially malicious previous page URL" , ( ) => {
380+ req [ "rawHeaders" ] = [ "Referer" , `http://host-name/illegal-path` ] ;
381+
382+ const previousPage = urlUtils . getPreviousPageUrl ( req , config . REGISTER_AN_OVERSEAS_ENTITY_URL ) ;
383+
384+ // Check that the "http://host-name/illegal-path" url is not returned
385+ expect ( previousPage ) . toBeUndefined ( ) ;
386+ } ) ;
387+
388+ test ( "returns undefined if no url found in headers" , ( ) => {
389+ req [ "rawHeaders" ] = [ "Referer" , "" ] ;
390+
391+ const previousPage = urlUtils . getPreviousPageUrl ( req , config . REGISTER_AN_OVERSEAS_ENTITY_URL ) ;
392+
393+ expect ( previousPage ) . toBeUndefined ( ) ;
394+ } ) ;
395+ } ) ;
396+
368397 describe ( "getBackLinkUrl tests" , ( ) => {
369398 const urlWithEntityIds = "/transaction/:transactionId/submission/:submissionId/entity" ;
370399 const urlWithoutEntityIds = "/entity" ;
0 commit comments