feat: Website für IONOS und neue Rubriken aktualisieren

server.mjs

@@ -1,8 +1,8 @@
 import { createReadStream, existsSync, statSync } from "node:fs";
 import { createServer } from "node:http";
-import { extname, join, normalize } from "node:path";
+import { extname, join, relative, resolve, sep } from "node:path";
 
-const root = process.cwd();
+const root = resolve(process.cwd(), "src", "website");
 const port = Number(process.env.PORT || 4173);
 
 const mimeTypes = {
@@ -19,10 +19,16 @@ const mimeTypes = {
 createServer((request, response) => {
   const pathname = decodeURIComponent(new URL(request.url, `http://${request.headers.host}`).pathname);
   const requested = pathname === "/" ? "/index.html" : pathname;
-  const safePath = normalize(requested).replace(/^(\.\.(\/|\\|$))+/, "");
-  let filePath = join(root, safePath);
+  let filePath = resolve(root, `.${requested}`);
+  const relativePath = relative(root, filePath);
+  const pathSegments = relativePath.split(sep);
 
-  if (!filePath.startsWith(root) || !existsSync(filePath)) {
+  if (
+    relativePath === ".." ||
+    relativePath.startsWith(`..${sep}`) ||
+    pathSegments.some((segment) => segment.startsWith(".")) ||
+    !existsSync(filePath)
+  ) {
     response.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
     response.end("Nicht gefunden");
     return;
@@ -32,6 +38,12 @@ createServer((request, response) => {
   response.writeHead(200, {
     "Content-Type": mimeTypes[extname(filePath).toLowerCase()] || "application/octet-stream",
     "Cache-Control": "no-cache",
+    "Content-Security-Policy":
+      "default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; form-action 'self'",
+    "Permissions-Policy": "camera=(), microphone=(), geolocation=()",
+    "Referrer-Policy": "strict-origin-when-cross-origin",
+    "X-Content-Type-Options": "nosniff",
+    "X-Frame-Options": "SAMEORIGIN",
   });
   createReadStream(filePath).pipe(response);
 }).listen(port, "127.0.0.1", () => {