sneak 729c0ff222 Encode ' in the source query; the generator compares the path as written ...

A "'" in the source query is percent-encoded with the other characters
a browser encodes in a query. The generator page compares the URL pixa
would fetch with the path as written, which url.URL keeps in RawPath,
so a path holding %2F is refused whatever else it holds. It also
refuses a source URL holding a user name and password, which pixa does
not send, and a source path holding a ".." segment, as /v1/image/ does.
README.md and TODO.md say so.

Model: opus-5-5

2026-10-16 01:02:08 +00:00

..

auth_clientip_internal_test.go

Resolve real client IP behind trusted proxies (closes #94)

2026-09-22 10:25:41 +02:00

auth_csrf_internal_test.go

CSRF protection on the login and URL-generator forms (closes #93)

2026-09-21 19:26:18 +02:00

auth_generate_internal_test.go

Validate dimensions and fit mode on encrypted URLs (closes #62)

2026-09-28 15:24:32 +02:00

auth_login_log_internal_test.go

Test metrics auth, CORS preflight, login logging and metrics (closes #79)

2026-10-04 14:39:27 +02:00

auth_session_internal_test.go

Logging out ends every login session (closes #256)

2026-10-15 20:44:44 +02:00

auth.go

Encode ' in the source query; the generator compares the path as written

2026-10-16 01:02:08 +00:00

bodylimit_internal_test.go

Harden http.Server: slowloris timeouts and form body limit (closes #92)

2026-09-21 20:59:24 +02:00

bodylimit.go

Harden http.Server: slowloris timeouts and form body limit (closes #92)

2026-09-21 20:59:24 +02:00

cache_max_bytes_internal_test.go

Count what the cache holds in the default cache_max_bytes (closes #184)

2026-10-04 19:41:49 +02:00

csrf.go

CSRF protection on the login and URL-generator forms (closes #93)

2026-09-21 19:26:18 +02:00

fetcher_internal_test.go

Test the image proxy flow end to end (closes #80)

2026-10-04 23:24:46 +02:00

format_auto_internal_test.go

Serve the format auto, chosen from the Accept header (closes #88)

2026-10-05 05:24:50 +02:00

format_auto.go

Serve and accept JPEG XL as an image format (part of #222)

2026-10-08 11:01:12 +02:00

handlers_internal_test.go

Remove the unused cache lifetime setting (closes #69)

2026-10-13 07:58:55 +02:00

handlers.go

Logging out ends every login session (closes #256)

2026-10-15 20:44:44 +02:00

healthcheck.go

Add doc comment to HandleHealthCheck method

2026-01-08 02:28:30 -08:00

image_cache_control_internal_test.go

Remove the unused cache lifetime setting (closes #69)

2026-10-13 07:58:55 +02:00

image_errors_internal_test.go

Refuse an image URL whose source path or query holds a # (closes #286)

2026-10-16 01:36:56 +02:00

image_signature_internal_test.go

Document how a source query goes into an image URL, and accept it (closes #255)

2026-10-16 00:17:33 +02:00

image.go

Document how a source query goes into an image URL, and accept it (closes #255)

2026-10-16 00:17:33 +02:00

imageenc_internal_test.go

Return and pass on request IDs, and give /v1/e/ ETag, 304 and HEAD (closes #84)

2026-10-04 12:41:54 +02:00

imageenc_token_internal_test.go

Test logging in, logging out, the URL generator and /v1/e/ tokens (closes #77)

2026-10-04 19:24:39 +02:00

imageenc.go

Stop a transcode whose request has ended before it encodes (closes #243)

2026-10-15 18:44:11 +02:00

jpegxl_default_internal_test.go

Serve JPEG XL when a request names no format (closes #222)

2026-10-08 12:49:56 +02:00

jpegxl_internal_test.go

Serve and accept JPEG XL as an image format (part of #222)

2026-10-08 11:01:12 +02:00

referer_blocklist_internal_test.go

Remove the unused cache lifetime setting (closes #69)

2026-10-13 07:58:55 +02:00

request_id_internal_test.go

Return and pass on request IDs, and give /v1/e/ ETag, 304 and HEAD (closes #84)

2026-10-04 12:41:54 +02:00

robots_healthcheck_internal_test.go

Test the image route's signature check and error answers (closes #76)

2026-10-04 13:58:29 +02:00

server_busy_internal_test.go

Stop a transcode whose request has ended before it encodes (closes #243)

2026-10-15 18:44:11 +02:00

unsupported_source_internal_test.go

Refuse SVG sources and never save an unknown input as JPEG (closes #68)

2026-10-13 07:13:17 +02:00