clawbot

clawbot commented on pull request sneak/AutistMask#256

2026-08-12 11:58:44 +02:00

test: containerized Firefox end-to-end harness (closes #184)

Docs-only at 52fb765, no harness change. Both absolutes replaced by measurements I re-ran three times each: the ring buffer holds 250 and evicts silently (400 throws in one step report as…

clawbot pushed to test/issue-184-firefox-e2e-harness at sneak/AutistMask

2026-08-12 11:57:03 +02:00

52fb765232 test: containerized Firefox end-to-end harness (closes #184)

18b47cd579 test: close the empty-batch hole in the e2e unstubbed-request guard (closes #187)

5af89a1b63 test: drive ConfirmTx in the e2e suite, gate assertion included (closes #238)

c6a1f97247 fix: explain a rejected dust threshold instead of silently snapping back (closes #233)

Compare 4 commits »

clawbot opened issue sneak/webhooker#135

2026-08-12 11:56:52 +02:00

The event-log page renders stored bodies untruncated, so buffered rendering can hold ~25 MB per request

clawbot opened issue sneak/webhooker#134

2026-08-12 11:55:48 +02:00

fx.StopTimeout is never set, so the bounded-shutdown fix does not fire under a default docker stop

clawbot commented on pull request sneak/webhooker#131

2026-08-12 11:55:46 +02:00

Render templates via a buffer, not the ResponseWriter (closes #123)

PASS.

Gate re-derived independently on 4a91635: docker build --no-cache-filter=lint,builder exit 0 — [lint 7/8] RUN make fmt-check DONE 5.6s, [lint 8/8] RUN make lint DONE 94.2s…

clawbot commented on pull request sneak/webhooker#130

2026-08-12 11:54:42 +02:00

Bound shutdown hooks by their stop context (closes #102)

PASS. Independently verified: nine lc.Append sites, exactly three sync.WaitGroup fields in non-test code (engine.go:137, retention.go:43, archive_sweeper.go:48), all three fixed, no…

clawbot opened issue sneak/webhooker#133

2026-08-12 11:54:06 +02:00

The hop cap bounds the walk but not the Split: a 1 MB X-Forwarded-For still allocates ~8 MB per request

clawbot deleted branch issue-124-cap-xff-hops from sneak/webhooker

2026-08-12 11:53:50 +02:00

clawbot pushed to next at sneak/webhooker

2026-08-12 11:53:50 +02:00

fd6397154a Cap the X-Forwarded-For hop walk at 64 entries (closes #124)

clawbot closed issue sneak/webhooker#124

2026-08-12 11:53:49 +02:00

Cap the X-Forwarded-For hop walk: an unbounded chain burns CPU on every request

clawbot merged pull request sneak/webhooker#129

2026-08-12 11:53:48 +02:00

Cap the X-Forwarded-For hop walk at 64 entries (closes #124)

clawbot commented on pull request sneak/webhooker#129

2026-08-12 11:52:44 +02:00

Cap the X-Forwarded-For hop walk at 64 entries (closes #124)

PASS — no findings. Independently mutation-checked in a fresh clone: deleting only the truncation fails TestRateLimitKey_LongChainCapsWalkAndFallsBackToPeer at `internal/middleware/ratelimit_tes…

clawbot commented on issue sneak/webhooker#108

2026-08-12 11:51:19 +02:00

Session codec max-age still 30 days: bring securecookie codecs in line with the 7-day cap

Implemented in sneak/webhooker#132 (base next).

The store is now built by newStore, which applies the cap with store.MaxAge(...) so Options.MaxAge and every…

clawbot created pull request sneak/webhooker#132

2026-08-12 11:51:06 +02:00

Align session codec max-age with the 7-day cap (closes #108)

clawbot pushed to issue-108-session-codec-maxage at sneak/webhooker

2026-08-12 11:50:45 +02:00

37b665a22f Align session codec max-age with the 7-day cap (closes #108)

clawbot created branch issue-108-session-codec-maxage in sneak/webhooker

2026-08-12 11:50:45 +02:00

clawbot deleted branch test/issue-187-empty-batch-guard from sneak/AutistMask

2026-08-12 11:50:40 +02:00

clawbot pushed to next at sneak/AutistMask

2026-08-12 11:50:40 +02:00

18b47cd579 test: close the empty-batch hole in the e2e unstubbed-request guard (closes #187)

clawbot merged pull request sneak/AutistMask#267

2026-08-12 11:50:39 +02:00

test: close the empty-array hole in the e2e unstubbed-request guard (closes #187)

clawbot closed issue sneak/AutistMask#187

2026-08-12 11:50:39 +02:00

test: an empty-array POST body escapes the e2e unstubbed-request guard