This produces URLs like /v1/image/cdn.example.com/photo.jpg?foo=bar/800x600.webp where ?foo=bar/800x600.webp becomes the query string, not the path. The size/format segment after the ? is parsed as a query parameter, not as a path segment.
The URL parser (ParseImagePath) expects the size segment as the last path component before any query string, so this generated URL cannot be parsed back correctly.
Impact
Signed URLs for sources with query strings are broken - they will return 400 Bad Request when accessed.
Fix
The query string in the source URL should be encoded into the path differently, matching how ParseImageURL expects it. Looking at the URL parser, it expects the format host/path?query/size.format where the ?query is embedded in a path segment. But this conflicts with how HTTP URLs work. The correct fix is to encode the source query into the path segment (not as an actual query string) so the URL remains parseable.
## Bug
In `internal/imgcache/signature.go`, `GenerateSignedURL()` embeds the query string mid-path:
```go
path = fmt.Sprintf("/v1/image/%s%s?%s/%s.%s",
req.SourceHost,
req.SourcePath,
req.SourceQuery,
sizeStr,
req.Format,
)
```
This produces URLs like `/v1/image/cdn.example.com/photo.jpg?foo=bar/800x600.webp` where `?foo=bar/800x600.webp` becomes the query string, not the path. The size/format segment after the `?` is parsed as a query parameter, not as a path segment.
The URL parser (`ParseImagePath`) expects the size segment as the last path component before any query string, so this generated URL cannot be parsed back correctly.
## Impact
Signed URLs for sources with query strings are broken - they will return 400 Bad Request when accessed.
## Fix
The query string in the source URL should be encoded into the path differently, matching how `ParseImageURL` expects it. Looking at the URL parser, it expects the format `host/path?query/size.format` where the `?query` is embedded in a path segment. But this conflicts with how HTTP URLs work. The correct fix is to encode the source query into the path segment (not as an actual query string) so the URL remains parseable.
clawbot
self-assigned this 2026-02-09 00:56:06 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Bug
In
internal/imgcache/signature.go,GenerateSignedURL()embeds the query string mid-path:This produces URLs like
/v1/image/cdn.example.com/photo.jpg?foo=bar/800x600.webpwhere?foo=bar/800x600.webpbecomes the query string, not the path. The size/format segment after the?is parsed as a query parameter, not as a path segment.The URL parser (
ParseImagePath) expects the size segment as the last path component before any query string, so this generated URL cannot be parsed back correctly.Impact
Signed URLs for sources with query strings are broken - they will return 400 Bad Request when accessed.
Fix
The query string in the source URL should be encoded into the path differently, matching how
ParseImageURLexpects it. Looking at the URL parser, it expects the formathost/path?query/size.formatwhere the?queryis embedded in a path segment. But this conflicts with how HTTP URLs work. The correct fix is to encode the source query into the path segment (not as an actual query string) so the URL remains parseable.