clawbot 3a6b3bc202 Refuse an IPv6 address that holds an internal IPv4 address (closes #297) ...

The check that keeps pixa from fetching internal addresses read an
IPv6 address as IPv4 only in the mapped form (::ffff:a.b.c.d), so the
IPv4-compatible form, such as ::127.0.0.1, was judged as IPv6 and
passed. An address in ::/96 is now judged by the IPv4 address it holds,
so one holding a private, loopback or link-local address is refused on
both image routes before any upstream request. The NAT64 range
64:ff9b::/96 stays blocked whole, as it was on next.

Model: opus-5-5

2026-10-16 05:31:55 +02:00

..

testdata

Serve and accept JPEG XL as an image format (part of #222)

2026-10-08 11:01:12 +02:00

computed_side_internal_test.go

Refuse a size whose computed side exceeds the maximum (closes #241)

2026-10-13 09:44:44 +02:00

cors_internal_test.go

Send CORS headers only from the image routes (closes #98)

2026-10-03 17:49:43 +02:00

fit_outside_internal_test.go

Refuse a fit=outside size whose output exceeds the maximum (closes #257)

2026-10-13 10:44:45 +02:00

format_auto_internal_test.go

Serve the format auto, chosen from the Accept header (closes #88)

2026-10-05 05:24:50 +02:00

http_internal_test.go

Add the four settings the README documented but pixa lacked (closes #61)

2026-09-29 08:49:18 +02:00

http.go

Exit with the shutdown's code and wait for image processing (closes #86)

2026-10-04 04:59:30 +02:00

image_proxy_internal_test.go

Test the image proxy flow end to end (closes #80)

2026-10-04 23:24:46 +02:00

image_rate_limit_internal_test.go

Limit each client's requests to the image routes (closes #236)

2026-10-13 01:36:18 +02:00

jpegxl_internal_test.go

Serve and accept JPEG XL as an image format (part of #222)

2026-10-08 11:01:12 +02:00

login_rate_limit_internal_test.go

Answer image requests with 503 in maintenance mode (closes #71)

2026-09-29 11:01:30 +02:00

logout_internal_test.go

Logging out ends every login session (closes #256)

2026-10-15 20:44:44 +02:00

maintenance_internal_test.go

Send CORS headers only from the image routes (closes #98)

2026-10-03 17:49:43 +02:00

metrics_internal_test.go

Test metrics auth, CORS preflight, login logging and metrics (closes #79)

2026-10-04 14:39:27 +02:00

request_id_internal_test.go

Return and pass on request IDs, and give /v1/e/ ETag, 304 and HEAD (closes #84)

2026-10-04 12:41:54 +02:00

routes_internal_test.go

Return and pass on request IDs, and give /v1/e/ ETag, 304 and HEAD (closes #84)

2026-10-04 12:41:54 +02:00

routes.go

Logging out ends every login session (closes #256)

2026-10-15 20:44:44 +02:00

server.go

Exit with the shutdown's code and wait for image processing (closes #86)

2026-10-04 04:59:30 +02:00

shutdown_internal_test.go

Exit with the shutdown's code and wait for image processing (closes #86)

2026-10-04 04:59:30 +02:00

source_url_internal_test.go

Refuse an IPv6 address that holds an internal IPv4 address (closes #297)

2026-10-16 05:31:55 +02:00

svg_as_avif_internal_test.go

Refuse SVG sources and never save an unknown input as JPEG (closes #68)

2026-10-13 07:13:17 +02:00

svg_internal_test.go

Refuse SVG sources and never save an unknown input as JPEG (closes #68)

2026-10-13 07:13:17 +02:00