sneak c6ee690e83 Refuse an image URL host that no URL host can be ...

Only @ was refused in the host of a /v1/image/ URL, so a ? written as
%3F gave the host cdn.example.com?x=1, which Go's URL parser reads as
cdn.example.com with a query: it passed the allowlist and each text
after the ? was cached under keys of its own. The host must now be a
host name or an IPv4 address (letters, digits, -, _ and .) or an IPv6
address in brackets, either one optionally followed by : and a port;
anything else is refused with 400. An IPv6 address without brackets,
which needed a signature, is refused too.

Model: opus-5-5

2026-10-15 22:30:24 +00:00

..

testdata

Add failing test for AVIF decoding

2026-01-08 13:09:40 -08:00

cache_internal_test.go

Remove the unused cache lifetime setting (closes #69)

2026-10-13 07:58:55 +02:00

cache_usage_internal_test.go

Eviction no longer reads a whole table while requests wait on the database (closes #227)

2026-10-08 07:12:02 +02:00

cache.go

Sync cached files and refuse ones left empty or partial (closes #252)

2026-10-15 19:27:33 +02:00

cachesize_internal_test.go

Count what the cache holds in the default cache_max_bytes (closes #184)

2026-10-04 19:41:49 +02:00

cachesize.go

Re-vendor the canonical files from sneak/prompts at e3f79c4 (closes #221)

2026-10-15 22:40:38 +02:00

concurrent_misses_internal_test.go

Stop a transcode whose request has ended before it encodes (closes #243)

2026-10-15 18:44:11 +02:00

contentlock_internal_test.go

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

contentlock.go

feat: cache size management and LRU eviction (closes #51) (#55)

2026-08-09 13:22:51 +02:00

divzero_internal_test.go

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

eviction_internal_test.go

Remove the unused cache lifetime setting (closes #69)

2026-10-13 07:58:55 +02:00

eviction.go

Sync cached files and refuse ones left empty or partial (closes #252)

2026-10-15 19:27:33 +02:00

imgcache.go

Serve and accept JPEG XL as an image format (part of #222)

2026-10-08 11:01:12 +02:00

max_concurrent_processing_internal_test.go

Bound concurrent image processing and upstream fetches (closes #64)

2026-09-29 10:32:16 +02:00

metacache_internal_test.go

Keep variant content types in memory for cache hits (closes #70)

2026-09-29 12:00:10 +02:00

module.go

Remove the unused cache lifetime setting (closes #69)

2026-10-13 07:58:55 +02:00

negative_cache_internal_test.go

Remove expired negative cache rows in the eviction loop (closes #244)

2026-10-15 15:02:27 +02:00

partial_cache_files_internal_test.go

Sync cached files and refuse ones left empty or partial (closes #252)

2026-10-15 19:27:33 +02:00

pendingcounts_internal_test.go

Keep counts not written by the request's deadline in memory (closes #224)

2026-10-13 03:07:23 +02:00

pendingcounts.go

Keep counts not written by the request's deadline in memory (closes #224)

2026-10-13 03:07:23 +02:00

service_internal_test.go

Lower-case the image URL's host and require a signature for a port (closes #246)

2026-10-15 12:31:14 +02:00

service.go

Default max_concurrent_processing to half the CPUs pixa sees (closes #242)

2026-10-15 23:07:22 +02:00

sourceurl_internal_test.go

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

stats_internal_test.go

Remove the unused cache lifetime setting (closes #69)

2026-10-13 07:58:55 +02:00

storage_internal_test.go

Escape : and % in the signed and cached path and query (closes #247)

2026-10-15 09:37:01 +02:00

storage.go

Sync cached files and refuse ones left empty or partial (closes #252)

2026-10-15 19:27:33 +02:00

testutil_internal_test.go

Remove the unused cache lifetime setting (closes #69)

2026-10-13 07:58:55 +02:00

urlparser_internal_test.go

Document how a source query goes into an image URL, and accept it (closes #255)

2026-10-16 00:17:33 +02:00

urlparser.go

Refuse an image URL host that no URL host can be

2026-10-15 22:30:24 +00:00

validate_internal_test.go

Validate dimensions and fit mode on encrypted URLs (closes #62)

2026-09-28 15:24:32 +02:00