clawbot
d47aea67b8
check / check (push) Waiting to run
The fetcher accepts image/svg+xml; internal/magic detects SVG. orig of an SVG at the orig size is the SVG unchanged, cached, with a Content-Security-Policy allowing only its styles and data: images; at another size, ErrSVGNotOriginalSize (400). Any other format renders it at the least size covering the output, at most 8192 on a side, so it stays sharp. Rendering refuses an SVG with a side over 8192 times the other (ErrSVGTooThin, 415), and the orig size of one above 8192 on a side (ErrSVGTooLargeForOrigSize, 400). The cache reads up to 1024 first bytes to find a file's format. Tests pinning the SVG refusal now expect SVG. Render time and memory are unbounded: P1 in TODO.md until the owner decides on #68. Model: opus-5-5
1.2 KiB
1.2 KiB
Workflow
- branch per issue from
next - do the work in Next Step
- delete Next Step from
TODO.md TODO.mdmerges with git's union merge (.gitattributes), which never reports a conflict: read the merged entries after every merge or rebase- move the top item of Future Steps into Next Step
- commit (
TODO.mdchanges in the same commit as the work) - open a PR based on
next - an independent reviewer who did not write the change gates it
- the manager squash-merges the PR into
nextonce review passes nextstays green and mergeable tomainat any time; only the owner mergesnextintomain, via the single milestone PR- push
Status
pre-1.0. The 1.0.0 milestone is in progress.
Next Step
P1: security: bound the time and memory of rendering an SVG source. Both grow with what the SVG draws, such as filter effects. govips cannot stop or limit a render. The bound is the owner's decision on #68.
Future Steps
- P2: security
- per-origin rate limiting
- P2: HTTP response handling
- Last-Modified headers
- P2: operational
- measure the 1k to 5k req/s target with
script/loadteston a machine not shared with other work
- measure the 1k to 5k req/s target with