fix(cdn): do not serve package.json or changelog

src/index.mjs

@@ -114,6 +114,13 @@ export async function main(req, ctx) {
     if (req.method === 'GET' && pathname.startsWith('/info.json')) {
       return respondInfo(ctx);
     }
+
+    // Block access to sensitive files
+    if (pathname.toLowerCase().includes('package.json') ||
+      pathname.toLowerCase().includes('changelog.md')) {
+      return respondError('Not Found', 404, undefined, req);
+    }
+
     const isDirList = (pathname.endsWith('/'));
     if (req.method === 'GET' && pathname.startsWith('/.rum/web-vitals')) {
       if (isDirList) {

test/post-deploy.test.mjs

@@ -260,5 +260,24 @@ import assert from 'assert';
       });
       assert.strictEqual(response.status, 400);
     });
+
+    it('Sensitive files return 404 - package.json', async function test() {
+      if (!process.env.TEST_INTEGRATION) {
+        this.skip();
+      }
+      const sensitiveUrls = [
+        '/.rum/@adobe/helix-rum-js@^2/package.json',
+        '/.rum/@adobe/helix-rum-js@^2/CHANGELOG.md'
+      ];
+
+      for (const url of sensitiveUrls) {
+        const response = await fetch(`https://${domain}${url}`, {
+          method: 'GET'
+        });
+        assert.strictEqual(response.status, 404, `Expected 404 for ${url}`);
+        const text = await response.text();
+        assert.match(text, /Not Found/);
+      }
+    });
   });
 });