Incorporate code review feedback

Author: jazairi

app/controllers/search_controller.rb

@@ -16,7 +16,7 @@ def results
     # inject session preference for boolean type if it is present
     params[:booleanType] = cookies[:boolean_type] || 'AND'
 
-    # inject queryMode from cookie if not provided in URL params
+    # inject hybrid queryMode if opted-in and no queryMode param provided
     params[:queryMode] = 'hybrid' if params[:queryMode].blank? && cookies[:natural_language_search_optin] == 'true'
 
     @enhanced_query = Enhancer.new(params).enhanced_query

app/views/search/results.html.erb

@@ -18,7 +18,6 @@
       <% elsif @results.present? && @errors.blank? %>
 
         <h2 class="results-context" data-matomo-seen="Search, Results Found, Tab: {{getActiveTabName}}"><%= results_summary(@pagination[:hits]) %></h2>
-        <p class="results-context-description"><%= tab_description %></p>
         <% if @show_nls_warning %>
           <%= render partial: 'search/nls_alert' %>
         <% end %>

test/controllers/natural_language_search_optin_test.rb

@@ -85,6 +85,12 @@ def mock_primo_success
     assert_redirected_to root_path
   end
 
+  test 'external URLs redirect to route' do
+    get '/natural_language_search_optin?natural_language_search_optin=true&return_to=https://example.com/evil'
+    assert_response :redirect
+    assert_redirected_to root_path
+  end
+
   test 'toggle shows toggled-off by default (no cookie)' do
     mock_timdex_success
     get '/results?q=test&tab=timdex'
@@ -240,7 +246,7 @@ def mock_primo_success
     assert_select 'aside.nls-alert', count: 0
   end
 
-  test 'warning does not show on articles tab when opted-out' do
+  test 'warning does not show on cdi tab when opted-out' do
     get '/natural_language_search_optin?natural_language_search_optin=false'
 
     mock_primo_success
@@ -250,7 +256,7 @@ def mock_primo_success
     assert_select 'aside.nls-alert', count: 0
   end
 
-  test 'warning does not show on articles tab with no opt-in cookie' do
+  test 'warning does not show on cdi tab with no opt-in cookie' do
     mock_primo_success
     get '/results?q=test&tab=cdi'