Analyse: Messdienst: Heatmap-Pfad wie gespeicherter Pfad, Tests für Kodierung und Stunde

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

analytics/src/heat.js

@@ -1,7 +1,7 @@
 // GET /a/heat?token= (öffentlicher Listener): Klickpunkte für das Heatmap-Overlay.
 // Token (R3): <b64url(JSON {s,p,v,e})>.<hex HMAC-SHA256(heatSecret, b64part)>, e = Ablauf in Unix-Sekunden.
 import crypto from 'node:crypto';
-import { hostOf } from './ingest.js';
+import { hostOf, cleanPath } from './ingest.js';
 
 const SITE_KEY = /^[a-z0-9]{16,40}$/;
 const MAX_AHEAD = 30 * 60; // Sekunden
@@ -79,7 +79,7 @@ export function createHeat({ db, config = {}, now }) {
     }
     cors(res, req, domainsOf(site));
     const since = clock() - CLICK_DAYS * 86400 * 1000;
-    const points = getClicks.all(t.siteKey, t.path, t.vp, since, POINTS).map((r) => ({ x: r.x, y: r.y }));
+    const points = getClicks.all(t.siteKey, cleanPath(t.path) || t.path, t.vp, since, POINTS).map((r) => ({ x: r.x, y: r.y }));
     return end(200, { points });
   };
 }

analytics/src/ingest.js

@@ -64,7 +64,7 @@ function looksLikeId(seg) {
   return /\d{6,}/.test(d) || UUID.test(d) || d.includes('@');
 }
 
-function cleanPath(p) {
+export function cleanPath(p) {
   if (typeof p !== 'string') return null;
   const s = p.split(/[?#]/)[0];
   if (!s.startsWith('/') || s.length > 300 || /[\u0000-\u001f\u007f]/.test(s)) return null;