fix: add form-action and frame-ancestors to CSP header in redirects

default-src does not cover form-action or frame-ancestors directives per
CSP spec, so omitting them allows unrestricted behavior for those vectors.
Closes #187

Assisted-by AI: Claude (Anthropic)

Author: Sumit-Mayani

index.js

@@ -200,7 +200,7 @@ function createRedirectDirectoryListener () {
     res.statusCode = 301
     res.setHeader('Content-Type', 'text/html; charset=UTF-8')
     res.setHeader('Content-Length', Buffer.byteLength(doc))
-    res.setHeader('Content-Security-Policy', "default-src 'none'")
+    res.setHeader('Content-Security-Policy', "default-src 'none'; form-action 'none'; frame-ancestors 'none'")
     res.setHeader('X-Content-Type-Options', 'nosniff')
     res.setHeader('Location', loc)
     res.end(doc)

test/test.js

@@ -510,7 +510,7 @@ describe('serveStatic()', function () {
     it('should respond with default Content-Security-Policy', function (done) {
       request(server)
         .get('/users')
-        .expect('Content-Security-Policy', "default-src 'none'")
+        .expect('Content-Security-Policy', "default-src 'none'; form-action 'none'; frame-ancestors 'none'")
         .expect(301, done)
     })