sneak/pixa
1
0
Fork 0
Code Issues 13 Pull Requests 5 Actions 7 Packages Projects Releases Wiki Activity

Refuse an image URL whose source path or query holds a # (closes #286) #287

Merged
clawbot merged 2 commits from issue-286-hash-in-source-path into next 2026-10-16 01:36:57 +02:00
Conversation 1 Commits 2 Files Changed 4
+64 -2
2 Commits
Author SHA1 Message Date
sneak ca96d8da37 Refuse an image URL whose source path or query holds a # (closes #286)
check / check (push) Canceled after 0s
Details 
A # written as %23 reached the parser decoded and stayed in the source
path or query. The source URL built from it ended at the # when it was
fetched, so each text after it fetched the same upstream image, without
a signature for an allowlisted host, and cached it under keys of its
own. Such a URL is now refused with 400, and README.md says neither the
source path nor the source query may hold a #.

Model: opus-5-5
 2026-10-15 23:21:57 +00:00
sneak 9119667c31 Test that a # in the source path or query is refused with 400
check / check (push) Canceled after 0s
Details 
The image route serves these today: the source URL ends at the #, so
each text after it fetches the same upstream image and caches it under
keys of its own.

Model: opus-5-5
 2026-10-15 23:19:03 +00:00