Pin three untested guards: download timer, URL fragment, short APP1 (closes #89)
check / check (push) Successful in 15s

The download idle deadline's timer is unref'd so it never holds the
process open, and a test checks no timer is left after a download
completes or fails. A test covers the rejection of "#" in a request
path. The EXIF scan compares the Exif header only when the APP1 length
is at least 8, so it never reads the next segment's bytes.

Model: opus-5-5
This commit is contained in:
clawbot
2026-09-23 01:17:43 +00:00
parent 28a2beeab8
commit a0e6828693
5 changed files with 75 additions and 3 deletions
+6
View File
@@ -18,6 +18,12 @@ Tag v1.0.0.
# Completed Steps
- 2026-09-23: Pinned three guards reviewers found untested (issue 89). The
download idle deadline's timer is unref'd, so it can never keep the process
alive, and a test checks no timer is left after a download completes or fails.
A test covers the rejection of `#` in a request path. The EXIF scan compares
the `Exif` header only in an APP1 segment of length 8 or more, so it never
reads the next segment's bytes, with a test for a short one.
- 2026-09-23: Made the download deadline an idle deadline (issue 24).
`downloadTimeoutMs` now aborts a file or thumbnail download only after no
bytes have arrived for that long, default 60 seconds, instead of bounding the