setupSPA in internal/server/routes.go took the file name from request.URL.Path[1:], which panics when the path is empty. An absolute-form request line with no path (GET http://host HTTP/1.1) gives an empty path, so any client could make the server answer 500 and log a stack trace. It now uses strings.TrimPrefix(request.URL.Path, "/"). An empty name fails to read from the embedded files, so the request gets the index page through the fallback that already serves GET / and unknown paths.
internal/server/routes_test.go sends such a request and expects 200 and the index page. The package had no tests before; internal/server/export_test.go gives the test a Server whose router has only the web client route, following the export_test.go files in internal/ircserver and internal/db.
Judgement call: the test builds its request with httptest.NewRequestWithContext(t.Context(), ...) rather than httptest.NewRequest; the request and its empty path are the same.
Partially verified: in the Docker test build web/dist/index.html is an empty placeholder, so there the body check compares empty with empty; the status and the absence of a panic carry the test.
Model: opus-5-5
`setupSPA` in `internal/server/routes.go` took the file name from `request.URL.Path[1:]`, which panics when the path is empty. An absolute-form request line with no path (`GET http://host HTTP/1.1`) gives an empty path, so any client could make the server answer `500` and log a stack trace. It now uses `strings.TrimPrefix(request.URL.Path, "/")`. An empty name fails to read from the embedded files, so the request gets the index page through the fallback that already serves `GET /` and unknown paths.
`internal/server/routes_test.go` sends such a request and expects `200` and the index page. The package had no tests before; `internal/server/export_test.go` gives the test a `Server` whose router has only the web client route, following the `export_test.go` files in `internal/ircserver` and `internal/db`.
Closes https://git.eeqj.de/sneak/neoirc/issues/149
- Judgement call: the test builds its request with `httptest.NewRequestWithContext(t.Context(), ...)` rather than `httptest.NewRequest`; the request and its empty path are the same.
- Partially verified: in the Docker test build `web/dist/index.html` is an empty placeholder, so there the body check compares empty with empty; the status and the absence of a panic carry the test.
Model: opus-5-5
setupSPA took the file name from request.URL.Path[1:], which panics
when the path is empty, as it is for an absolute-form request line
with no path ("GET http://host HTTP/1.1"). It now trims a leading "/"
instead; an empty name fails to read, so the request gets the index
page, as "/" already does.
The new test in internal/server sends such a request and expects 200
and the index page. export_test.go gives it a Server whose router has
only the web client route.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
setupSPAininternal/server/routes.gotook the file name fromrequest.URL.Path[1:], which panics when the path is empty. An absolute-form request line with no path (GET http://host HTTP/1.1) gives an empty path, so any client could make the server answer500and log a stack trace. It now usesstrings.TrimPrefix(request.URL.Path, "/"). An empty name fails to read from the embedded files, so the request gets the index page through the fallback that already servesGET /and unknown paths.internal/server/routes_test.gosends such a request and expects200and the index page. The package had no tests before;internal/server/export_test.gogives the test aServerwhose router has only the web client route, following theexport_test.gofiles ininternal/ircserverandinternal/db.Closes #149
httptest.NewRequestWithContext(t.Context(), ...)rather thanhttptest.NewRequest; the request and its empty path are the same.web/dist/index.htmlis an empty placeholder, so there the body check compares empty with empty; the status and the absence of a panic carry the test.Model: opus-5-5
setupSPA took the file name from request.URL.Path[1:], which panics when the path is empty, as it is for an absolute-form request line with no path ("GET http://host HTTP/1.1"). It now trims a leading "/" instead; an empty name fails to read, so the request gets the index page, as "/" already does. The new test in internal/server sends such a request and expects 200 and the index page. export_test.go gives it a Server whose router has only the web client route. Model: opus-5-5PASS
Model: opus-5-5