sneak 9dbb3ffe07 Test that the image URL's host is one spelling (part of #246) ...

The image URL parser must lower-case the host and refuse one holding
"@", which a URL reads as a user name and password before the host;
ErrInvalidHost is added for that refusal. A host with a port, or a ":"
with no port, must match no allowlist entry, so its request needs a
signature. All three tests fail until the fix.

Model: opus-5-5

2026-10-15 02:59:07 +00:00

..

allowlist

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

app

Move pixad's startup from cmd/pixad into internal/app (closes #206)

2026-10-05 01:07:47 +02:00

clientip

Resolve real client IP behind trusted proxies (closes #94)

2026-09-22 10:25:41 +02:00

config

Limit each client's requests to the image routes (closes #236)

2026-10-13 01:36:18 +02:00

database

Queue SQLite writes on one connection so none fails as locked (closes #223)

2026-10-08 04:50:31 +02:00

db/migrations

Eviction no longer reads a whole table while requests wait on the database (closes #227)

2026-10-08 07:12:02 +02:00

encurl

Serve JPEG XL when a request names no format (closes #222)

2026-10-08 12:49:56 +02:00

globals

Move pixad's startup from cmd/pixad into internal/app (closes #206)

2026-10-05 01:07:47 +02:00

handlers

Refuse a size whose computed side exceeds the maximum (closes #241)

2026-10-13 09:44:44 +02:00

healthcheck

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

httpfetcher

Refuse SVG sources and never save an unknown input as JPEG (closes #68)

2026-10-13 07:13:17 +02:00

imageprocessor

Refuse a fit=outside size whose output exceeds the maximum (closes #257)

2026-10-13 10:44:45 +02:00

imgcache

Test that the image URL's host is one spelling (part of #246)

2026-10-15 02:59:07 +00:00

loadtestorigin

Add script/loadtest to measure throughput, latency and memory (closes #81)

2026-10-05 02:58:41 +02:00

logger

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

magic

Serve and accept JPEG XL as an image format (part of #222)

2026-10-08 11:01:12 +02:00

middleware

Limit each client's requests to the image routes (closes #236)

2026-10-13 01:36:18 +02:00

seal

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

server

Refuse a fit=outside size whose output exceeds the maximum (closes #257)

2026-10-13 10:44:45 +02:00

session

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

signature

Include quality and fit in the URL signature (closes #60)

2026-09-28 13:02:21 +02:00

static

Remove unsafe-inline from the Content-Security-Policy (closes #125)

2026-10-04 18:58:40 +02:00

templates

Serve JPEG XL when a request names no format (closes #222)

2026-10-08 12:49:56 +02:00