sneak/pixa
1
0
Fork 0
Code Issues 22 Pull Requests 12 Actions 51 Packages Projects Releases Wiki Activity

Escape : and % in the signed and cached path and query (closes #247) #269

Merged
clawbot merged 2 commits from issue-247-unambiguous-signed-data into next 2026-10-15 09:37:02 +02:00
Conversation 1 Commits 2 Files Changed 6
+212 -10
2 Commits
Author SHA1 Message Date
sneak 6209798793 Escape : and % in the signed and cached path and query (closes #247)
check / check (push) Waiting to run
Details 
The signed data and the cache key joined host, path and query with ":"
and no escaping, so path /a:b with no query and path /a with query b:
gave the same string: a URL signed for one verified for the other, and
whichever was fetched first was served for both. Both now write each "%"
in the path and query as "%25" and each ":" as "%3A" before joining them.
A path and query holding neither are signed and keyed as before.
"Signature Specification" in README.md states the escaping.

Model: opus-5-5
 2026-10-15 05:38:34 +00:00
sneak c4015858fa Test that a colon cannot move where the path ends and the query begins
check / check (push) Waiting to run
Details 
A URL signed for path /a:b with no query must not verify for path /a with
query b:, and the two must not share a cache key. New known-answer vectors
pin the signature of a path with ":", a query with ":", and a "%" in path
and query, with "%" written as "%25" and ":" as "%3A" in the signed data.
These fail until the fix for
#247 lands.

Model: opus-5-5
 2026-10-15 04:58:20 +00:00