When AllowHTTP is configured (for testing), the fetcher validates the URL scheme and the HTTP fetcher creates the request, but the source URL is always https://. This means in testing mode with HTTP-only test servers, fetches will either fail with TLS errors or connect to the wrong port.
The AllowHTTP config is set but SourceURL() has no awareness of it, making the entire AllowHTTP feature broken for any real HTTP upstream.
Impact
Blocks testing with local HTTP servers. The AllowHTTP config option is effectively non-functional for the image proxy pipeline.
Fix
Pass the scheme through ImageRequest or add a method parameter. The cleanest approach is to add a Scheme field to ImageRequest that defaults to https but can be set to http when AllowHTTP is true.
## Bug
`ImageRequest.SourceURL()` in `internal/imgcache/imgcache.go` always prepends `https://`:
```go
func (r *ImageRequest) SourceURL() string {
url := "https://" + r.SourceHost + r.SourcePath
```
When `AllowHTTP` is configured (for testing), the fetcher validates the URL scheme and the HTTP fetcher creates the request, but the source URL is always `https://`. This means in testing mode with HTTP-only test servers, fetches will either fail with TLS errors or connect to the wrong port.
The `AllowHTTP` config is set but `SourceURL()` has no awareness of it, making the entire `AllowHTTP` feature broken for any real HTTP upstream.
## Impact
Blocks testing with local HTTP servers. The `AllowHTTP` config option is effectively non-functional for the image proxy pipeline.
## Fix
Pass the scheme through `ImageRequest` or add a method parameter. The cleanest approach is to add a `Scheme` field to `ImageRequest` that defaults to `https` but can be set to `http` when `AllowHTTP` is true.
clawbot
self-assigned this 2026-02-09 00:56:06 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Bug
ImageRequest.SourceURL()ininternal/imgcache/imgcache.goalways prependshttps://:When
AllowHTTPis configured (for testing), the fetcher validates the URL scheme and the HTTP fetcher creates the request, but the source URL is alwayshttps://. This means in testing mode with HTTP-only test servers, fetches will either fail with TLS errors or connect to the wrong port.The
AllowHTTPconfig is set butSourceURL()has no awareness of it, making the entireAllowHTTPfeature broken for any real HTTP upstream.Impact
Blocks testing with local HTTP servers. The
AllowHTTPconfig option is effectively non-functional for the image proxy pipeline.Fix
Pass the scheme through
ImageRequestor add a method parameter. The cleanest approach is to add aSchemefield toImageRequestthat defaults tohttpsbut can be set tohttpwhenAllowHTTPis true.