sneak/pixa
1
0
Fork 0
Code Issues 13 Pull Requests 5 Actions 75 Packages Projects Releases Wiki Activity

Fetch the source path and query URL-encoded, not joined as text (closes #288) #289

Merged
clawbot merged 4 commits from issue-288-encode-source-url into next 2026-10-16 03:31:16 +02:00
Conversation 4 Commits 4 Files Changed 6
+502 -16
4 Commits
Author SHA1 Message Date
sneak 729c0ff222 Encode ' in the source query; the generator compares the path as written
check / check (push) Waiting to run
Details 
A "'" in the source query is percent-encoded with the other characters
a browser encodes in a query. The generator page compares the URL pixa
would fetch with the path as written, which url.URL keeps in RawPath,
so a path holding %2F is refused whatever else it holds. It also
refuses a source URL holding a user name and password, which pixa does
not send, and a source path holding a ".." segment, as /v1/image/ does.
README.md and TODO.md say so.

Model: opus-5-5
 2026-10-16 01:02:08 +00:00
sneak 5bfec71b61 Test the generator refusals and a "'" in the source query 
Through the router: a source query holding "'" must reach the upstream
as %27. The generator page must answer 400, show the URL pixa would
fetch and make no encrypted URL for a source path holding %2F next to a
space, a "|" or a letter outside ASCII, and for a source URL holding a
user name and password. It must also refuse a source path holding a ".."
segment, as /v1/image/ does. These fail on the branch; the fix follows.

Model: opus-5-5
 2026-10-16 01:02:02 +00:00
sneak 545507e9d4 Fetch the source path and query URL-encoded, not joined as text (closes #288) 
The source path, decoded, is fetched percent-encoded again by net/url,
so 100%25.png fetches /100%25.png, and my%20cat.png and my%2520cat.png
fetch different paths. The source query stays as the source URL writes
it; the characters a browser percent-encodes in a query, such as a
space, are percent-encoded when the image URL is read, so the query is
signed and cached as it is sent. The generator page answers 400 for a
source URL its image URL would fetch written another way, such as with
%2F in the path, and shows the URL pixa would fetch. README.md says how
the source path and query are fetched.

Model: opus-5-5
 2026-10-16 00:47:13 +00:00
sneak af5ce499b9 Test that the source URL is fetched with its path and query encoded 
Through the router, against a test upstream that records each request
it receives: a space in the source query, 100%25.png, the source paths
written my%20cat.png and my%2520cat.png, one source query written two
ways, and the generator page with %20, %25 and %23 in the source URL,
and with %2F in its path, which the page must refuse. These fail on
next; the fix for #288 follows.

Model: opus-5-5
 2026-10-16 00:47:13 +00:00