sneak/pixa

Document how a source query goes into an image URL, and accept it (closes #255) #281

Merged

clawbot merged 4 commits from issue-255-source-query-in-signed-url into next

2026-10-16 00:17:34 +02:00

Author	SHA1	Message	Date
sneak	88ea15eda8	Accept a source path or query holding %25 in an image URL check / check (push) Waiting to run Details The path traversal check now reads only the host and source path, not the source query, and keeps a "%" that does not start a percent-escape as it is, decoding the escapes around it, instead of refusing the URL. Stopping the decoding at that "%" would let a double-encoded ".." elsewhere in the path through. Model: opus-5-5	2026-10-15 21:47:17 +00:00
sneak	c49d509a21	Test that a source path or query holding %25 passes the signature check check / check (push) Canceled after 0s Details A source URL holding %25, a literal "%", written by the README rule or by GenerateSignedURL, is refused with 400: the path traversal check refuses the "%" that one more decoding leaves. A double-encoded ".." next to such a "%" must stay refused. Model: opus-5-5	2026-10-15 21:40:55 +00:00
sneak	f9c878161a	Document how a source query goes into an image URL, and accept it (closes #255 ) check / check (push) Canceled after 0s Details The query follows the source path after %3F. The image route now parses the request's path decoded once instead of chi's wildcard, which holds the path as the client wrote it whenever that is not Go's own encoding of it, so a / ; or , written as %2F, %3B or %2C, as GenerateSignedURL wrote them, hid the %3F and the request failed with 401. Now the ? and every % in the source path or query must be percent-encoded and any other character may be. GenerateSignedURL writes Go's own encoding of the path. The README states the rule, with an example and its signature. Model: opus-5-5	2026-10-15 21:14:59 +00:00
sneak	4634d2dc2f	Test that a source query in an image URL reaches the signature check Round trips through a chi router for source queries holding /, ;, ,, =, &, ? and a percent-escape, both as GenerateSignedURL writes them and with characters other than ? and % percent-encoded, plus the README's example of a source URL with a query. These fail until the fix. Model: opus-5-5	2026-10-15 21:12:25 +00:00