The generator page passes the source host and path into the encrypted
URL as entered, so a host written in upper and in lower case, or a
source URL with no path and with the path /, make two cache keys and
two upstream requests for one image. This test enters each pair on the
generator page, requests both encrypted URLs, and expects one upstream
request and a cache hit for the second. It fails until the page
lower-cases the host and writes an empty path as /.
Model: opus-5-5
The source URL was built by joining the decoded path and query as
text, so a space in the query reached the upstream raw and failed with
502, 100%25.png made a URL Go could not parse and answered 401, and
%20 and %2520 fetched the same path under different cache keys. The
source URL is now built with net/url, so each decoded path and query is
one upstream request matching its signature and cache key; the query
encodes the characters a browser encodes, ' included. The generator page
compares what pixa would fetch with the URL as entered, and answers 400
with the URL to use when they differ, or for a user name and password
or a .. segment.
Model: opus-5-5
sneak
clawbot