fix: harden webapp static file serving

Author: Lukas Geiger

CHANGELOG.md

@@ -12,6 +12,9 @@ Format basiert auf [Keep a Changelog](https://keepachangelog.com/de/1.1.0/).
 - GitHub-Actions-Smoke-Matrix pinnt Windows auf `windows-2025-vs2026` und macOS auf `macos-26`, damit die 2026-Runner-Migration vor dem Stichtag validiert wird.
 
 ### Fehlerbehebungen / Bug Fixes
+- `webapp/server.py`: Statische Dateien werden nur noch über strikt normalisierte
+  Pfade unterhalb der erlaubten Roots ausgeliefert; Content-Types kommen aus
+  einer festen Endungs-Whitelist statt aus frei abgeleiteten Pfadwerten.
 - **UX-001** (`MethodenAnalyser3.py`): Die Hauptaktionen der Tkinter-GUI hatten keine sichtbaren Tastaturhinweise und keine direkten Shortcuts. Fix: kompakte Shortcut-Zeile (`Alt+D`, `Alt+P`, `Alt+F`, `F1`) ergänzt, globale Tastaturkürzel gebunden und die Initialansicht auf Tastaturnutzung vorbereitet. Regressionstests in `tests/test_cli.py` sichern Hinweistext und Shortcut-Bindings ab.
 - **B-004** (`MethodenAnalyser3.py`): `auto_fix_unused_imports` las Dateien ausschließlich als UTF-8, was bei Latin-1-kodierten Quellcode-Dateien zu `UnicodeDecodeError` führte. Fix: UTF-8-First mit `latin-1`-Fallback via `readlines()` (Zeilennummern bleiben mit `ast.lineno` synchron). 9 Regressionstests in `tests/test_cli.py` ergänzt.
 - **B-005** (`MethodenAnalyser3.py`): `analyze_project` fing nur `IOError`/`OSError`, nicht `UnicodeDecodeError` — Latin-1-Dateien brachen den gesamten Projekt-Scan ab. Fix: `UnicodeDecodeError` in denselben `except`-Block aufgenommen.

tests/test_webapp_server.py

@@ -7,9 +7,16 @@
 import urllib.request
 import zipfile
 from http.server import ThreadingHTTPServer
+from pathlib import Path
 from urllib.request import urlopen
 
-from webapp.server import MethodenAnalyserPwaHandler, analyze_payload, build_runtime_info
+from webapp.server import (
+    MethodenAnalyserPwaHandler,
+    _content_type_for_path,
+    _resolve_under,
+    analyze_payload,
+    build_runtime_info,
+)
 
 
 class MethodenAnalyserWebappServerTests(unittest.TestCase):
@@ -112,6 +119,26 @@ def test_runtime_info_for_wildcard_server_includes_lan_urls(self) -> None:
             ["http://10.0.0.8:8765/", "http://192.168.0.5:8765/"],
         )
 
+    def test_resolve_under_blocks_traversal(self) -> None:
+        root = Path(__file__).resolve().parent
+        self.assertIsNone(_resolve_under(root, "../test_cli.py"))
+        self.assertIsNone(_resolve_under(root, "/tmp/test_cli.py"))
+
+    def test_resolve_under_allows_existing_child_file(self) -> None:
+        root = Path(__file__).resolve().parent
+        expected = (root / "test_webapp_server.py").resolve()
+        self.assertEqual(_resolve_under(root, "test_webapp_server.py"), expected)
+
+    def test_content_type_uses_fixed_suffix_map(self) -> None:
+        self.assertEqual(
+            _content_type_for_path(Path("app.webmanifest")),
+            "application/manifest+json; charset=utf-8",
+        )
+        self.assertEqual(
+            _content_type_for_path(Path("payload.bad\r\nX-Test: 1")),
+            "application/octet-stream",
+        )
+
 
 class MethodenAnalyserInvalidBodyTests(unittest.TestCase):
     """Verifies that malformed POST bodies return 400, not 500."""

webapp/server.py

@@ -6,8 +6,6 @@
 import io
 import ipaddress
 import json
-import mimetypes
-import os
 import socket
 import sys
 import tempfile
@@ -40,12 +38,16 @@
 )
 
 
-mimetypes.add_type("application/manifest+json", ".webmanifest")
-mimetypes.add_type("text/javascript", ".js")
-mimetypes.add_type("text/css", ".css")
-
 LOCAL_ONLY_HOSTS = {"127.0.0.1", "::1", "localhost"}
 WILDCARD_HOSTS = {"0.0.0.0", "::"}
+CONTENT_TYPES_BY_SUFFIX = {
+    ".css": "text/css; charset=utf-8",
+    ".html": "text/html; charset=utf-8",
+    ".js": "text/javascript; charset=utf-8",
+    ".json": "application/json; charset=utf-8",
+    ".png": "image/png",
+    ".webmanifest": "application/manifest+json; charset=utf-8",
+}
 
 
 def _clean_filename(filename: Any, source_kind: str) -> str:
@@ -172,15 +174,31 @@ def analyze_payload(payload: dict[str, Any]) -> dict[str, Any]:
 
 
 def _resolve_under(root: Path, relative_path: str) -> Path | None:
-    root = root.resolve()
-    target = (root / relative_path).resolve()
-    if target == root or root not in target.parents:
+    resolved_root = root.resolve()
+    normalized_path = relative_path.replace("\\", "/").strip()
+    if not normalized_path:
+        return None
+    relative = PurePosixPath(normalized_path)
+    if relative.is_absolute():
+        return None
+    if any(part in {"", ".", ".."} for part in relative.parts):
+        return None
+    target = root.joinpath(*relative.parts).resolve()
+    try:
+        target.relative_to(resolved_root)
+    except ValueError:
+        return None
+    if target == resolved_root:
         return None
     if not target.is_file():
         return None
     return target
 
 
+def _content_type_for_path(target: Path) -> str:
+    return CONTENT_TYPES_BY_SUFFIX.get(target.suffix.lower(), "application/octet-stream")
+
+
 def _discover_candidate_ipv4_addresses() -> list[str]:
     addresses: set[str] = set()
 
@@ -334,7 +352,7 @@ def _send_file_or_404(self, target: Path | None) -> None:
             self._send_json({"ok": False, "error": "Datei nicht gefunden."}, status=404)
             return
 
-        content_type = mimetypes.guess_type(str(target))[0] or "application/octet-stream"
+        content_type = _content_type_for_path(target)
         try:
             body = target.read_bytes()
         except OSError as exc: