1
84%
master: 84%

Ran 18 Apr 2026 04:12AM UTC

Files 50

Run time 1s

Badge

Embed ▾

Committed 18 Apr 2026 04:09AM UTC coverage: 84.365% (+0.02%) from 84.345%

Job # 24596576498.1

Build Type

Pull #2045

github

Committed by

paskal

Commit Message

fix(api): reject control characters in /picture URL segments

Address PR #2045 review feedback (Copilot #2045-1). The previous
safePictureSegment allowed CR/LF/TAB through, so a request such as
GET /api/v1/picture/dev%0Auser/abc.png would inject literal newlines
into the access log line ("GET - /api/v1/picture/dev\nuser/abc.png ...")
— a log-forgery primitive against any operator parsing those logs.

Reject any unicode.IsControl rune in either segment (NUL was already
caught via strings.ContainsAny). New TestRest_LoadPictureRejectsControlCharsInSegment
covers LF, CR, TAB, NUL across both segments.

Pull Request Pull Request #2045: fix(api): reject path traversal in /picture/{user}/{id}

Coverage Stats

6243 of 7400 relevant lines covered (84.36%)

34.62 hits per line

umputun / remark42 / 24596576498 / 1
84%
master: 84%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 24596576498.1

umputun / remark42 / 24596576498 / 1 84% master: 84%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 24596576498.1

umputun / remark42 / 24596576498 / 1
84%
master: 84%

README BADGES
x