clawbot 4a4bc9758f Fetch the source path and query URL-encoded, not joined as text (closes #288) ...

The source URL was built by joining the decoded path and query as
text, so a space in the query reached the upstream raw and failed with
502, 100%25.png made a URL Go could not parse and answered 401, and
%20 and %2520 fetched the same path under different cache keys. The
source URL is now built with net/url, so each decoded path and query is
one upstream request matching its signature and cache key; the query
encodes the characters a browser encodes, ' included. The generator page
compares what pixa would fetch with the URL as entered, and answers 400
with the URL to use when they differ, or for a user name and password
or a .. segment.

Model: opus-5-5

2026-10-16 03:31:15 +02:00

..

auth_clientip_internal_test.go

Resolve real client IP behind trusted proxies (closes #94)

2026-09-22 10:25:41 +02:00

auth_csrf_internal_test.go

CSRF protection on the login and URL-generator forms (closes #93)

2026-09-21 19:26:18 +02:00

auth_generate_internal_test.go

Validate dimensions and fit mode on encrypted URLs (closes #62)

2026-09-28 15:24:32 +02:00

auth_login_log_internal_test.go

Test metrics auth, CORS preflight, login logging and metrics (closes #79)

2026-10-04 14:39:27 +02:00

auth_session_internal_test.go

Logging out ends every login session (closes #256)

2026-10-15 20:44:44 +02:00

auth.go

Fetch the source path and query URL-encoded, not joined as text (closes #288)

2026-10-16 03:31:15 +02:00

bodylimit_internal_test.go

Harden http.Server: slowloris timeouts and form body limit (closes #92)

2026-09-21 20:59:24 +02:00

bodylimit.go

Harden http.Server: slowloris timeouts and form body limit (closes #92)

2026-09-21 20:59:24 +02:00

cache_max_bytes_internal_test.go

Count what the cache holds in the default cache_max_bytes (closes #184)

2026-10-04 19:41:49 +02:00

csrf.go

CSRF protection on the login and URL-generator forms (closes #93)

2026-09-21 19:26:18 +02:00

fetcher_internal_test.go

Test the image proxy flow end to end (closes #80)

2026-10-04 23:24:46 +02:00

format_auto_internal_test.go

Serve the format auto, chosen from the Accept header (closes #88)

2026-10-05 05:24:50 +02:00

format_auto.go

Serve and accept JPEG XL as an image format (part of #222)

2026-10-08 11:01:12 +02:00

handlers_internal_test.go

Remove the unused cache lifetime setting (closes #69)

2026-10-13 07:58:55 +02:00

handlers.go

Logging out ends every login session (closes #256)

2026-10-15 20:44:44 +02:00

healthcheck.go

Add doc comment to HandleHealthCheck method

2026-01-08 02:28:30 -08:00

image_cache_control_internal_test.go

Remove the unused cache lifetime setting (closes #69)

2026-10-13 07:58:55 +02:00

image_errors_internal_test.go

Refuse an image URL whose source path or query holds a # (closes #286)

2026-10-16 01:36:56 +02:00

image_signature_internal_test.go

Document how a source query goes into an image URL, and accept it (closes #255)

2026-10-16 00:17:33 +02:00

image.go

Document how a source query goes into an image URL, and accept it (closes #255)

2026-10-16 00:17:33 +02:00

imageenc_internal_test.go

Return and pass on request IDs, and give /v1/e/ ETag, 304 and HEAD (closes #84)

2026-10-04 12:41:54 +02:00

imageenc_token_internal_test.go

Test logging in, logging out, the URL generator and /v1/e/ tokens (closes #77)

2026-10-04 19:24:39 +02:00

imageenc.go

Stop a transcode whose request has ended before it encodes (closes #243)

2026-10-15 18:44:11 +02:00

jpegxl_default_internal_test.go

Serve JPEG XL when a request names no format (closes #222)

2026-10-08 12:49:56 +02:00

jpegxl_internal_test.go

Serve and accept JPEG XL as an image format (part of #222)

2026-10-08 11:01:12 +02:00

referer_blocklist_internal_test.go

Remove the unused cache lifetime setting (closes #69)

2026-10-13 07:58:55 +02:00

request_id_internal_test.go

Return and pass on request IDs, and give /v1/e/ ETag, 304 and HEAD (closes #84)

2026-10-04 12:41:54 +02:00

robots_healthcheck_internal_test.go

Test the image route's signature check and error answers (closes #76)

2026-10-04 13:58:29 +02:00

server_busy_internal_test.go

Stop a transcode whose request has ended before it encodes (closes #243)

2026-10-15 18:44:11 +02:00

unsupported_source_internal_test.go

Refuse SVG sources and never save an unknown input as JPEG (closes #68)

2026-10-13 07:13:17 +02:00