clawbot
62b4f4791e
check / check (push) Canceled after 0s
A ? written into the host segment as %3F reached the parser decoded, so cdn.example.com?x=1 passed the allowlist as cdn.example.com, fetched the host's root path with that query, and was cached under its own keys: another unsigned spelling of one upstream request. The host segment is now accepted only as a host name, an IPv4 address or a bracketed IPv6 address, with an optional port, and anything else is refused with 400. An IPv6 address without brackets is now refused instead of needing a signature; a host name outside ASCII is refused, its punycode accepted. Model: opus-5-5