umputun / remark42 / 24596576498

84%

master: 84%

Build Type

Pull #2045

github

Committed by paskal

Commit Message

fix(api): reject control characters in /picture URL segments

Address PR #2045 review feedback (Copilot #2045-1). The previous
safePictureSegment allowed CR/LF/TAB through, so a request such as
GET /api/v1/picture/dev%0Auser/abc.png would inject literal newlines
into the access log line ("GET - /api/v1/picture/dev\nuser/abc.png ...")
— a log-forgery primitive against any operator parsing those logs.

Reject any unicode.IsControl rune in either segment (NUL was already
caught via strings.ContainsAny). New TestRest_LoadPictureRejectsControlCharsInSegment
covers LF, CR, TAB, NUL across both segments.

Pull Request Pull Request #2045: fix(api): reject path traversal in /picture/{user}/{id}

Coverage Stats

23 of 25 new or added lines in 1 file covered. (92.0%)

2 existing lines in 1 file now uncovered.

6243 of 7400 relevant lines covered (84.36%)

34.62 hits per line