Move address bar spoofing server routes out of server.js

security/address-bar-spoofing/server/routes.js

@@ -0,0 +1,10 @@
+const express = require('express');
+const router = express.Router();
+
+// Returns a 301 redirect to a download link of our browser
+// for use in the download path test
+router.get('/download-redirect', (req, res) => {
+    res.redirect(301, 'https://staticcdn.duckduckgo.com/macos-desktop-browser/duckduckgo.dmg');
+});
+
+module.exports = router;

security/address-bar-spoofing/spoof-js-download-url.html

@@ -11,7 +11,7 @@
       const w = open()
       w.opener = null
       w.document.write('<h1>Not DDG.</h1>')
-      w.location = 'https://tyny.to/s509a8'
+      w.location = '/security/address-bar-spoofing/download-redirect'
     }
   </script>
 </head>

server.js

@@ -274,3 +274,6 @@ app.use('/features/client-hints', chRoutes);
 
 const clearDataRoutes = require('./features/clear-data/server/routes.js');
 app.use('/features/clear-data', clearDataRoutes);
+
+const addressBarSpoofingRoutes = require('./security/address-bar-spoofing/server/routes.js');
+app.use('/security/address-bar-spoofing', addressBarSpoofingRoutes);