sneak
c6ee690e83
check / check (push) Canceled after 0s
Only @ was refused in the host of a /v1/image/ URL, so a ? written as %3F gave the host cdn.example.com?x=1, which Go's URL parser reads as cdn.example.com with a query: it passed the allowlist and each text after the ? was cached under keys of its own. The host must now be a host name or an IPv4 address (letters, digits, -, _ and .) or an IPv6 address in brackets, either one optionally followed by : and a port; anything else is refused with 400. An IPv6 address without brackets, which needed a signature, is refused too. Model: opus-5-5