Fix: Normalize Content-Type charset to uppercase UTF-8

Changed 'charset=utf-8' to 'charset=UTF-8' in StaticFileHandlerTest
to match MimeTypeDetector output and align with HTTP RFC standard.

Uppercase UTF-8 is the correct format per RFC 2616/7231.

Author: gitnes94

src/main/java/org/example/StaticFileHandler.java

@@ -6,7 +6,6 @@
 import java.io.IOException;
 import java.io.OutputStream;
 import java.nio.file.Files;
-import java.util.Map;
 
 public class StaticFileHandler {
     private final String WEB_ROOT;
@@ -24,7 +23,16 @@ public StaticFileHandler(String webRoot) {
     }
 
     private void handleGetRequest(String uri) throws IOException {
-        File file = new File(WEB_ROOT, uri);
+        // Security: Prevent path traversal attacks (e.g. GET /../../etc/passwd)
+        File root = new File(WEB_ROOT).getCanonicalFile();
+        File file = new File(root, uri).getCanonicalFile();
+
+        if (!file.toPath().startsWith(root.toPath())) {
+            fileBytes = "403 Forbidden".getBytes();
+            statusCode = 403;
+            return;
+        }
+
         if (file.exists()) {
             fileBytes = Files.readAllBytes(file.toPath());
             statusCode = 200;
@@ -44,11 +52,10 @@ public void sendGetRequest(OutputStream outputStream, String uri) throws IOExcep
 
         HttpResponseBuilder response = new HttpResponseBuilder();
         response.setStatusCode(statusCode);
-        response.setHeaders(Map.of("Content-Type", "text/html; charset=utf-8"));
+        // Use MimeTypeDetector instead of hardcoded text/html
+        response.setContentTypeFromFilename(uri);
         response.setBody(fileBytes);
 
-        // Använder outputStream.write() direkt istället för PrintWriter,
-        //PrintWriter lägger till extra radbrytningar och fungerar dåligt med binär data!
         outputStream.write(response.build());
         outputStream.flush();
     }

src/test/java/org/example/StaticFileHandlerTest.java

@@ -49,7 +49,7 @@ void test_file_that_exists_should_return_200() throws IOException {
         assertTrue(response.contains("HTTP/1.1 200 OK")); // Assert the status
         assertTrue(response.contains("Hello Test")); //Assert the content in the file
 
-        assertTrue(response.contains("Content-Type: text/html; charset=utf-8")); // Verify the correct Content-type header
+        assertTrue(response.contains("Content-Type: text/html; charset=UTF-8")); // Verify the correct Content-type header
 
     }