sneak ca96d8da37 Refuse an image URL whose source path or query holds a # (closes #286) ...

A # written as %23 reached the parser decoded and stayed in the source
path or query. The source URL built from it ended at the # when it was
fetched, so each text after it fetched the same upstream image, without
a signature for an allowlisted host, and cached it under keys of its
own. Such a URL is now refused with 400, and README.md says neither the
source path nor the source query may hold a #.

Model: opus-5-5

2026-10-15 23:21:57 +00:00

..

allowlist

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

app

Move pixad's startup from cmd/pixad into internal/app (closes #206)

2026-10-05 01:07:47 +02:00

clientip

Resolve real client IP behind trusted proxies (closes #94)

2026-09-22 10:25:41 +02:00

config

Default max_concurrent_processing to half the CPUs pixa sees (closes #242)

2026-10-15 23:07:22 +02:00

database

Queue SQLite writes on one connection so none fails as locked (closes #223)

2026-10-08 04:50:31 +02:00

db/migrations

Logging out ends every login session (closes #256)

2026-10-15 20:44:44 +02:00

encurl

Serve JPEG XL when a request names no format (closes #222)

2026-10-08 12:49:56 +02:00

globals

Move pixad's startup from cmd/pixad into internal/app (closes #206)

2026-10-05 01:07:47 +02:00

handlers

Test that a # in the source path or query is refused with 400

2026-10-15 23:19:03 +00:00

healthcheck

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

httpfetcher

Accept a chunked upstream body of exactly the maximum size (closes #248)

2026-10-15 07:44:09 +02:00

imageprocessor

Default max_concurrent_processing to half the CPUs pixa sees (closes #242)

2026-10-15 23:07:22 +02:00

imgcache

Refuse an image URL whose source path or query holds a # (closes #286)

2026-10-15 23:21:57 +00:00

loadtestorigin

Add script/loadtest to measure throughput, latency and memory (closes #81)

2026-10-05 02:58:41 +02:00

logger

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

magic

Serve and accept JPEG XL as an image format (part of #222)

2026-10-08 11:01:12 +02:00

middleware

Label request metrics with standard HTTP methods only (closes #274)

2026-10-15 21:47:11 +02:00

seal

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

server

Logging out ends every login session (closes #256)

2026-10-15 20:44:44 +02:00

session

Logging out ends every login session (closes #256)

2026-10-15 20:44:44 +02:00

signature

Document how a source query goes into an image URL, and accept it (closes #255)

2026-10-16 00:17:33 +02:00

static

Logging out ends every login session (closes #256)

2026-10-15 20:44:44 +02:00

templates

Logging out ends every login session (closes #256)

2026-10-15 20:44:44 +02:00