Security fixes pass #2

dist/functions/server/handle-public.js

@@ -2,13 +2,14 @@ import grabDirNames from "../../utils/grab-dir-names";
 import path from "path";
 import isDevelopment from "../../utils/is-development";
 import { existsSync } from "fs";
+import isSafePath from "../../utils/is-safe-path";
 const { PUBLIC_DIR } = grabDirNames();
 export default async function ({ req }) {
     try {
         const is_dev = isDevelopment();
         const url = new URL(req.url);
         const file_path = path.join(PUBLIC_DIR, url.pathname.replace(/^\/public/, ""));
-        if (!file_path.startsWith(PUBLIC_DIR + path.sep)) {
+        if (!isSafePath({ filePath: file_path, allowedDir: PUBLIC_DIR })) {
             return new Response("Forbidden", { status: 403 });
         }
         return readFileResponse({ file_path });
@@ -33,6 +34,9 @@ export function readFileResponse({ file_path, cache }) {
     else if (cache?.duration) {
         headers.set("Cache-Control", `public, max-age=${cache.duration}`);
     }
+    else if (!isDevelopment()) {
+        headers.set("Cache-Control", "public, max-age=3600");
+    }
     return new Response(file, {
         headers,
     });