The generator page put the source host and path into the encrypted URL as entered, so CDN.Example.com and cdn.example.com, or a source URL with no path and with the path /, made two cache keys and two upstream requests for one image. The page now lower-cases the host and writes an empty path as /, as /v1/image/ reads a source URL, before anything else uses it.
Things the diff does not show:
The change sits in a new function, parseSourceURL, called where url.Parse was. HandleGenerateURL was already at the linter's length limit, so the two changes could not go inline.
It runs before the check from #289 that pixa fetches the URL as entered, so that check compares / with /, and https://cdn.example.com?x=1 still makes an image URL. That check is unchanged.
The test is in the existing router test file internal/server/source_url_internal_test.go and is committed first; no existing test changed.
Disclosures:
Deviation: the host-case pair is [2001:DB8::A]:8443 and [2001:db8::a]:8443, not a host name, because the fetcher looks a host name up in DNS before it connects.
Judgement call: the README's Encrypted URLs section gains one sentence saying the token keeps the host in lower case and an empty path as /.
The port is in the test because the fetcher refuses an IPv6 address written without one; I have not fixed that here.
Model: opus-5-5
Fixes https://git.eeqj.de/sneak/pixa/issues/293.
The generator page put the source host and path into the encrypted URL as entered, so `CDN.Example.com` and `cdn.example.com`, or a source URL with no path and with the path `/`, made two cache keys and two upstream requests for one image. The page now lower-cases the host and writes an empty path as `/`, as `/v1/image/` reads a source URL, before anything else uses it.
Things the diff does not show:
- The change sits in a new function, `parseSourceURL`, called where `url.Parse` was. `HandleGenerateURL` was already at the linter's length limit, so the two changes could not go inline.
- It runs before the check from https://git.eeqj.de/sneak/pixa/pulls/289 that pixa fetches the URL as entered, so that check compares `/` with `/`, and `https://cdn.example.com?x=1` still makes an image URL. That check is unchanged.
- The test is in the existing router test file `internal/server/source_url_internal_test.go` and is committed first; no existing test changed.
Disclosures:
- Deviation: the host-case pair is `[2001:DB8::A]:8443` and `[2001:db8::a]:8443`, not a host name, because the fetcher looks a host name up in DNS before it connects.
- Judgement call: the README's Encrypted URLs section gains one sentence saying the token keeps the host in lower case and an empty path as `/`.
- The port is in the test because the fetcher refuses an IPv6 address written without one; I have not fixed that here.
Model: opus-5-5
The generator page passes the source host and path into the encrypted
URL as entered, so a host written in upper and in lower case, or a
source URL with no path and with the path /, make two cache keys and
two upstream requests for one image. This test enters each pair on the
generator page, requests both encrypted URLs, and expects one upstream
request and a cache hit for the second. It fails until the page
lower-cases the host and writes an empty path as /.
Model: opus-5-5
The generator page put the source host and path into the encrypted URL
as entered, so CDN.Example.com and cdn.example.com, or a source URL with
no path and with the path /, made two cache keys and two upstream
requests for one image. It now parses the source URL with the host
lower-cased and an empty path written as /, as /v1/image/ reads a
source URL, before the check that pixa fetches the URL as entered. That
is a small function of its own because HandleGenerateURL is at the
linter's length limit. The README says what the token keeps.
Model: opus-5-5
clawbot
self-assigned this 2026-10-16 03:46:44 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Fixes #293.
The generator page put the source host and path into the encrypted URL as entered, so
CDN.Example.comandcdn.example.com, or a source URL with no path and with the path/, made two cache keys and two upstream requests for one image. The page now lower-cases the host and writes an empty path as/, as/v1/image/reads a source URL, before anything else uses it.Things the diff does not show:
parseSourceURL, called whereurl.Parsewas.HandleGenerateURLwas already at the linter's length limit, so the two changes could not go inline./with/, andhttps://cdn.example.com?x=1still makes an image URL. That check is unchanged.internal/server/source_url_internal_test.goand is committed first; no existing test changed.Disclosures:
[2001:DB8::A]:8443and[2001:db8::a]:8443, not a host name, because the fetcher looks a host name up in DNS before it connects./.Model: opus-5-5
Review passed.
Model: opus-5-5