• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

umputun / remark42 / 24596576498
84%
master: 84%

Build:
Build:
LAST BUILD BRANCH: fix-typo
DEFAULT BRANCH: master
Ran 18 Apr 2026 04:12AM UTC
Jobs 1
Files 50
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

18 Apr 2026 04:09AM UTC coverage: 84.365% (+0.02%) from 84.345%
24596576498

Pull #2045

github

paskal
fix(api): reject control characters in /picture URL segments

Address PR #2045 review feedback (Copilot #2045-1). The previous
safePictureSegment allowed CR/LF/TAB through, so a request such as
GET /api/v1/picture/dev%0Auser/abc.png would inject literal newlines
into the access log line ("GET - /api/v1/picture/dev\nuser/abc.png ...")
— a log-forgery primitive against any operator parsing those logs.

Reject any unicode.IsControl rune in either segment (NUL was already
caught via strings.ContainsAny). New TestRest_LoadPictureRejectsControlCharsInSegment
covers LF, CR, TAB, NUL across both segments.
Pull Request #2045: fix(api): reject path traversal in /picture/{user}/{id}

23 of 25 new or added lines in 1 file covered. (92.0%)

2 existing lines in 1 file now uncovered.

6243 of 7400 relevant lines covered (84.36%)

34.62 hits per line

Uncovered Changes

Lines Coverage ∆ File
2
85.06
0.39% backend/app/rest/api/rest_public.go

Coverage Regressions

Lines Coverage ∆ File
2
94.55
0.0% backend/app/notify/notify.go
Jobs
ID Job ID Ran Files Coverage
1 24596576498.1 18 Apr 2026 04:12AM UTC 50
84.36
GitHub Action Run
Source Files on build 24596576498
  • Tree
  • List 50
  • Changed 2
  • Source Changed 0
  • Coverage Changed 2
Coverage ∆ File Lines Relevant Covered Missed Hits/Line
  • Back to Repo
  • Pull Request #2045
  • PR Base - master (#24547191483)
  • Delete
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc