sneak/pixa
1
0
Fork 0
Code Issues 50 Pull Requests 5 Actions Packages Projects Releases Wiki Activity
174 Commits 11 Branches 0 Tags
8dc46af6b7154772a3e53d83b734392e832fc772
Commit Graph
5 Commits
Author SHA1 Message Date
clawbot 37d49ade11 Harden http.Server: slowloris timeouts and form body limit (closes #92)
check / check (push) Failing after 1s
Details 
The http.Server now sets ReadHeaderTimeout (10s), which bounds the slow header dribble that ReadTimeout alone does not, and IdleTimeout (120s), which bounds keep-alive reuse. Server construction moved into a small helper so a test can assert the timeouts without binding a listener.

POST / and POST /generate bodies are capped at 1 MiB and an oversized body returns 413.

What a reader would trip over: the CSRF library reads its token from the form and swallows a parse error, so a cap applied only inside it would surface as 403. The body limit therefore parses the form under the cap before the CSRF check; the parsed form is reused afterwards. A test covers an oversized body that carries a valid token.

Judgement call: WriteTimeout stays at 60s; it also bounds how long a large image may take to send over a slow link.

Model: opus-4-8 (implementation, review); fable-5-1 (landing message)
 2026-09-21 20:59:24 +02:00
clawbot 04b5db6fbf next -> main (1.0.0 milestone) (#105)
check / check (push) Failing after 0s
Details 
Accumulating milestone branch. One squashed commit per closed issue; `next` is kept green and mergeable to `main` at any time without notice.

Landed so far:

- `chore: update golangci-lint to v2.12.2 with canonical config` (#54) — canonical v2-schema `.golangci.yml`, pins bumped in `Dockerfile` and `script/bootstrap`, tree at `0 issues.`. Three behaviour deltas are recorded in that PR's body: `Cache.StoreVariant` takes a context, `MetadataStorage.Store` no longer leaks temp files on failure, and the `signing_key` too-short error text gained a `value too short:` prefix.

Sequencing for the milestone is tracked in #103.

Reviewed-on: #105
Co-authored-by: clawbot <clawbot@noreply.example.org>
 2026-09-21 09:31:54 +02:00
sneak 146eeee070 Use bit shift for HTTPMaxHeaderBytes constant 2026-01-08 02:26:47 -08:00
sneak bf24a310bc Define HTTP server timeout and header size constants 2026-01-08 02:21:54 -08:00
sneak 516853626d Add basic webserver skeleton with healthcheck 2026-01-08 02:20:23 -08:00