A Worst-Case Approach to Safety and Reference Tracking for Cyber-Physical Systems Under Network Attacks