4 Commits

Include renames

Author	SHA1	Message	Date
sneak	e8ffd4e47f	Test that an IPv6 address holding an internal IPv4 address is refused ... The check that keeps pixa from fetching internal addresses reads an IPv6 address as IPv4 only in the mapped form (::ffff:a.b.c.d). These tests fail until it also judges the IPv4-compatible form (::/96), such as ::127.0.0.1 or ::10.0.0.1, by the IPv4 address it holds. The NAT64 form, 64:ff9b::7f00:1, is already refused and is tested alongside. Model: opus-5-5	2026-10-16 03:10:51 +00:00
clawbot	08d6c3c459	Fetch an IPv6 source host written without a port (closes #295) ... The fetcher took the host from the source URL and stripped a port with net.SplitHostPort, which fails when there is no port, so a bracketed IPv6 host such as [2001:db8::a] kept its brackets, its name lookup failed, and the request answered 500. validateURL now takes the host with url.URL.Hostname(), which drops the brackets and any port, so such a host is fetched like one with a port, through /v1/image/ and through an encrypted URL, and a private IPv6 address is still refused. Model: opus-5-5	2026-10-16 05:00:47 +02:00
clawbot	6d271d4617	Make one image URL per source on the generator page for host case and an empty path (closes #293) ... The generator page passed the source host and path into the encrypted URL as entered, so a host spelled in another letter case, or a source with no path against the same source with /, made separate cache keys and fetched one upstream image twice. The page now lower-cases the source host, as /v1/image/ does, and writes an empty source path as /, before it builds the encrypted URL. The checks the page gained for #288 still hold. Model: opus-5-5	2026-10-16 04:04:19 +02:00
clawbot	4a4bc9758f	Fetch the source path and query URL-encoded, not joined as text (closes #288) ... The source URL was built by joining the decoded path and query as text, so a space in the query reached the upstream raw and failed with 502, 100%25.png made a URL Go could not parse and answered 401, and %20 and %2520 fetched the same path under different cache keys. The source URL is now built with net/url, so each decoded path and query is one upstream request matching its signature and cache key; the query encodes the characters a browser encodes, ' included. The generator page compares what pixa would fetch with the URL as entered, and answers 400 with the URL to use when they differ, or for a user name and password or a .. segment. Model: opus-5-5	2026-10-16 03:31:15 +02:00