sneak d2a60a0750 Accept a source path or query holding %25 in an image URL ...

The path traversal check now reads only the host and source path, not
the source query, and keeps a "%" that does not start a percent-escape
as it is, decoding the escapes around it, instead of refusing the URL.
Stopping the decoding at that "%" would let a double-encoded ".."
elsewhere in the path through.

Model: opus-5-5

2026-10-15 21:43:53 +00:00

..

allowlist

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

app

Move pixad's startup from cmd/pixad into internal/app (closes #206)

2026-10-05 01:07:47 +02:00

clientip

Resolve real client IP behind trusted proxies (closes #94)

2026-09-22 10:25:41 +02:00

config

Default max_concurrent_processing to half the CPUs pixa sees (closes #242)

2026-10-15 23:07:22 +02:00

database

Queue SQLite writes on one connection so none fails as locked (closes #223)

2026-10-08 04:50:31 +02:00

db/migrations

Logging out ends every login session (closes #256)

2026-10-15 20:44:44 +02:00

encurl

Serve JPEG XL when a request names no format (closes #222)

2026-10-08 12:49:56 +02:00

globals

Move pixad's startup from cmd/pixad into internal/app (closes #206)

2026-10-05 01:07:47 +02:00

handlers

Test that a source path or query holding %25 passes the signature check

2026-10-15 21:40:55 +00:00

healthcheck

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

httpfetcher

Accept a chunked upstream body of exactly the maximum size (closes #248)

2026-10-15 07:44:09 +02:00

imageprocessor

Default max_concurrent_processing to half the CPUs pixa sees (closes #242)

2026-10-15 23:07:22 +02:00

imgcache

Accept a source path or query holding %25 in an image URL

2026-10-15 21:43:53 +00:00

loadtestorigin

Add script/loadtest to measure throughput, latency and memory (closes #81)

2026-10-05 02:58:41 +02:00

logger

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

magic

Serve and accept JPEG XL as an image format (part of #222)

2026-10-08 11:01:12 +02:00

middleware

Label request metrics with standard HTTP methods only (closes #274)

2026-10-15 21:47:11 +02:00

seal

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

server

Logging out ends every login session (closes #256)

2026-10-15 20:44:44 +02:00

session

Logging out ends every login session (closes #256)

2026-10-15 20:44:44 +02:00

signature

Document how a source query goes into an image URL, and accept it (closes #255)

2026-10-15 21:14:59 +00:00

static

Logging out ends every login session (closes #256)

2026-10-15 20:44:44 +02:00

templates

Logging out ends every login session (closes #256)

2026-10-15 20:44:44 +02:00