sneak 729c0ff222 Encode ' in the source query; the generator compares the path as written ...

A "'" in the source query is percent-encoded with the other characters
a browser encodes in a query. The generator page compares the URL pixa
would fetch with the path as written, which url.URL keeps in RawPath,
so a path holding %2F is refused whatever else it holds. It also
refuses a source URL holding a user name and password, which pixa does
not send, and a source path holding a ".." segment, as /v1/image/ does.
README.md and TODO.md say so.

Model: opus-5-5

2026-10-16 01:02:08 +00:00

..

allowlist

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

app

Move pixad's startup from cmd/pixad into internal/app (closes #206)

2026-10-05 01:07:47 +02:00

clientip

Resolve real client IP behind trusted proxies (closes #94)

2026-09-22 10:25:41 +02:00

config

Default max_concurrent_processing to half the CPUs pixa sees (closes #242)

2026-10-15 23:07:22 +02:00

database

Queue SQLite writes on one connection so none fails as locked (closes #223)

2026-10-08 04:50:31 +02:00

db/migrations

Logging out ends every login session (closes #256)

2026-10-15 20:44:44 +02:00

encurl

Serve JPEG XL when a request names no format (closes #222)

2026-10-08 12:49:56 +02:00

globals

Move pixad's startup from cmd/pixad into internal/app (closes #206)

2026-10-05 01:07:47 +02:00

handlers

Encode ' in the source query; the generator compares the path as written

2026-10-16 01:02:08 +00:00

healthcheck

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

httpfetcher

Accept a chunked upstream body of exactly the maximum size (closes #248)

2026-10-15 07:44:09 +02:00

imageprocessor

Crop the centre before resizing for fit=cover (closes #282)

2026-10-16 02:23:18 +02:00

imgcache

Encode ' in the source query; the generator compares the path as written

2026-10-16 01:02:08 +00:00

loadtestorigin

Add script/loadtest to measure throughput, latency and memory (closes #81)

2026-10-05 02:58:41 +02:00

logger

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

magic

Serve and accept JPEG XL as an image format (part of #222)

2026-10-08 11:01:12 +02:00

middleware

Label request metrics with standard HTTP methods only (closes #274)

2026-10-15 21:47:11 +02:00

seal

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

server

Test the generator refusals and a "'" in the source query

2026-10-16 01:02:02 +00:00

session

Logging out ends every login session (closes #256)

2026-10-15 20:44:44 +02:00

signature

Document how a source query goes into an image URL, and accept it (closes #255)

2026-10-16 00:17:33 +02:00

static

Logging out ends every login session (closes #256)

2026-10-15 20:44:44 +02:00

templates

Logging out ends every login session (closes #256)

2026-10-15 20:44:44 +02:00