fix(security): add image healthcheck and seccomp profile

.github/workflows/security.yml

@@ -1,8 +1,8 @@
 name: Security
 
 on:
-  schedule:
-    - cron: "0 6 * * 1" # weekly: catch newly published CVEs in unchanged code
+  push:
+    branches: [main]
   workflow_dispatch:
 
 permissions:

Dockerfile

@@ -26,4 +26,8 @@ USER 1000:1000
 
 EXPOSE 8080
 
+# Uses the binary's built-in probe; scratch has no shell or curl.
+HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
+  CMD ["/webdav-server", "--healthcheck"]
+
 ENTRYPOINT ["/webdav-server"]

internal/server/dirlist.go

@@ -6,6 +6,7 @@ import (
 	"html/template"
 	"log/slog"
 	"net/http"
+	"net/url"
 	"path"
 	"sort"
 	"strings"
@@ -72,7 +73,9 @@ func (h *dirListHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	if !strings.HasSuffix(urlPath, "/") {
 		fi, err := h.fs.Stat(r.Context(), urlPath)
 		if err == nil && fi.IsDir() {
-			http.Redirect(w, r, urlPath+"/", http.StatusMovedPermanently)
+			// Relative target: http.Redirect resolves it against the request
+			// path and cleans it, so "//host" can never become the Location.
+			http.Redirect(w, r, "./"+url.PathEscape(path.Base(urlPath))+"/", http.StatusMovedPermanently)
 			return
 		}
 	}

internal/server/dirlist_test.go

@@ -0,0 +1,44 @@
+package server
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"testing"
+
+	"golang.org/x/net/webdav"
+)
+
+func TestDirList_RedirectAddsTrailingSlash(t *testing.T) {
+	fs := webdav.NewMemFS()
+	for _, dir := range []string{"/files", "/files/sub dir", "/evil.com"} {
+		if err := fs.Mkdir(context.Background(), dir, os.ModePerm); err != nil {
+			t.Fatal(err)
+		}
+	}
+	h := &dirListHandler{webdav: &webdav.Handler{FileSystem: fs, LockSystem: webdav.NewMemLS()}, fs: fs}
+
+	tests := []struct {
+		path string
+		want string
+	}{
+		{"/files", "/files/"},
+		{"/files/sub dir", "/files/sub%20dir/"},
+		// Protocol-relative path must not redirect off-site.
+		{"//evil.com", "/evil.com/"},
+	}
+	for _, tt := range tests {
+		req := httptest.NewRequest(http.MethodGet, "/", nil)
+		req.URL.Path = tt.path
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+
+		if rec.Code != http.StatusMovedPermanently {
+			t.Errorf("%q: status = %d, want %d", tt.path, rec.Code, http.StatusMovedPermanently)
+		}
+		if got := rec.Header().Get("Location"); got != tt.want {
+			t.Errorf("%q: Location = %q, want %q", tt.path, got, tt.want)
+		}
+	}
+}

kubernetes/templates/deployment.yaml

@@ -22,6 +22,8 @@ spec:
         runAsGroup: 1000
         runAsNonRoot: true
         fsGroup: 1000
+        seccompProfile:
+          type: RuntimeDefault
       containers:
         - name: webdav
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"