Block a user
A client that stops sending its body after the app has answered is never timed out
Requests waiting for a client's first lookup are counted at the time they arrived, and one can wipe another's count
A ban's earlier_bans undercounts once a ban after an admin's ban is dropped
An answer from the app without a Content-Type can reach the client with one Go guessed
A path holding a character Go escapes reaches the app re-encoded, with an encoded slash turned into a slash
fix: sign and export with each address's own derivation index (closes #510)
PASS: sending, site transactions, site signatures and private key export now derive each address's key at its own stored derivation index and refuse a key that is not the shown address's, as…
Answer 504, not 408, when a request outlasts its time limit
- Fixed. A handler whose database read fails now asks one shared helper,
deadlinePassed, whether the request's time limit has passed, and if so answers 504 instead of 500 or 404, with the JSON…
chore: bring the token-list enrichment tooling into script/lib (closes #495)
FAIL (needs-rework)
script/lib/apply-enrichment.jslines 145–149,tests/applyEnrichment.test.js,Makefileline 122: an address in the data that matches no entry in `src/shared/toke…
Reconnect when RIS Live ends or stalls the stream
- Added
TestReconnectWhenServerNeverAnswers: the first response never sends headers and the streamer must reconnect after the idle limit; it fails when the idle timer starts only after the…
Sample the prefix-length pages with bounded lookups, each prefix once (closes #66)
internal/database/database.goline 1854,samplePrefixesByLength: no test makes the random lookups come up short, so the top-up from the shuffled prefixes can be dropped or broken with every…
Default rule file: a probe sent percent-encoded gets past its path rules
Built in sneak/smallwebwaf#125, as the brief above says. A path rule and a path in SWWAF_TRAP_PATHS now match the path as sent or decoded once, and the ban's notes…
Path rules and trap paths match the path decoded once too
fix: sign and export with each address's own derivation index (closes #510)
tests/addressKey.test.jsnow exports, sends, signs and confirms a site transaction as the first address after a recovery phrase import and after an xprv import whose scan finds only that…
fix: a V4 swap action not in the deployed shape is shown as not decoded (closes #358)
FAIL (needs-rework)
The earlier finding is resolved.
src/shared/uniswap.js, the V4 swap branch ofdecode()(lines 606 and 617). A V4 step whose swap action could not be read, and…
clawbot
pushed to issue-512-first-wallet-active-address at sneak/AutistMask
2026-10-14 17:40:01 +02:00
clawbot
created branch issue-512-first-wallet-active-address in sneak/AutistMask
2026-10-14 17:40:01 +02:00