alternative deviantart frontend, no javascript. go. http://git.krz.sh/krz/skunky-art.git/atom?h=main 2026-08-02T13:30:01+00:00 2026-08-02T13:30:01+00:00 Christian Cleberg hello@cleberg.net 2026-08-02T06:51:22+00:00 urn:sha1:4178e3893f310425e76f6d4515af9e7d0ea36a0a 2026-07-15T16:41:18+00:00 Christian Cleberg hello@cleberg.net 2026-07-15T16:41:18+00:00 urn:sha1:184ce2c6dcdd047d6888fd243b9189c797f58d38 * fix: make memcache concurrency-safe and stamp the version at link time memcache was a crash waiting for traffic. Readers touched tempFS without holding mx, while a per-entry goroutine deleted from it under the lock: a concurrent map read and map write, which the runtime treats as a fatal error that recover cannot catch. The option ships in config.example.json and was the one cache key SETUP.md never documented, so it read like a free win to enable. Put every map and field access behind the mutex, and age the whole map from one janitor instead of a goroutine per cached file, each of which looped forever holding its entry alive. mx is now a plain Mutex: every operation here mutates something, and the old code took an RLock to write. Document the option, and cover it with tests that run the readers, writers and janitor concurrently. Split the disk/origin fetch out of DownloadAndSendMedia while there, so the error path returns instead of falling through to write an empty body after the error page. Release.Version was hardcoded to 1.3.2, so images tagged v1.3.6 reported 1.3.2 from --help and /api/instance, and --help linked to the wrong release. Take it from a main.version string the release workflow links in from the git tag. * fix: reject forged subdomains in the media proxy DownloadAndSendMedia built its upstream URL by concatenation, pasting the subdomain segment of the request path straight into the host position. That segment reaches the handler already percent-decoded, so it can carry "@", "#", "?" and "/" — the characters that end a host. A request for /media/file/x@127.0.0.1:8080%2F/f/x.jpg built a URL whose host parsed as 127.0.0.1:8080, with images-wixmp-x demoted to userinfo, letting any caller aim the instance's fetcher at any address it could reach, including services behind the firewall. Validate the label against ^[a-zA-Z0-9-]+$ and refuse anything else with a 400. Rejecting rather than escaping is what closes this: the label is the host, and url.URL passes a host through verbatim, so building the URL structurally is not sufficient on its own. DeviantArt's own media URLs use a hex-and-dash label, and ParseMedia already splits on the first dot, so a legitimate label cannot contain one. Build the URL from url.URL fields as well, which escapes the path, and encode the token argument, which reached the request unescaped. Reported by CodeQL as go/request-forgery (CWE-918). 2026-07-15T08:17:09+00:00 Christian Cleberg hello@cleberg.net 2026-07-15T08:17:09+00:00 urn:sha1:83d9cd0b7a3e0ec6beb5c889102211567a6db03f Two independent faults made every image fail while pages still rendered. config.example.json shipped download-proxy=http://127.0.0.1:8080. Only media fetches go through that proxy — pages reach DeviantArt via devianter on the default transport — so when nothing listens there, images 502 and the rest of the page looks fine. In a scratch container 127.0.0.1 is the container itself, so the default could never work under Docker. Unset it and document that it must stay empty unless an operator really runs a proxy. Host was a package global reassigned by every request, so a concurrent request could overwrite it mid-render and emit URLs on another origin's host and port. The instance's own default-src 'self' CSP then blocked those images. Thread the request's host through skunkyart instead, and take it as an explicit argument in URLBuilder, ParseMedia, ParseDescription, BuildUserPlate and ConvertDeviantArtURLToSkunkyArt. Feeds keep their absolute URLs. Also start RefreshInstances after ExecuteConfig rather than before it: the goroutine read CFG while json.Unmarshal was writing it (a race the detector flags), and its fetch escaped both the throttle and the configured User-Agent. Verified: 300 concurrent requests with distinct Host headers now round-trip their own host (was 1 leak per 300), go test -race is clean, and cache+proxy both enabled serves 200 image/jpeg cold and from cache. 2026-07-15T01:22:26+00:00 Christian Cleberg hello@cleberg.net 2026-07-15T01:22:26+00:00 urn:sha1:5763dc3cfeadf491d6eda3b6a91623f86396a134 DeviantArt fronts its API with CloudFront + WAF, which bans egress IPs that hit it too hard. devianter issues requests with a bare http.Client, so unbounded concurrent handlers each pulled ~150-200 KB of JSON, which both risked a ban and could exhaust the process under a bot flood. Wrap the default transport to bound rate and concurrency for deviantart.com and add timeouts. Other hosts (wixmp image CDN) pass straight through, so media stays fast, and ProxyFromEnvironment is preserved so HTTPS_PROXY egress still works. 2026-07-15T01:22:04+00:00 Christian Cleberg hello@cleberg.net 2026-07-15T01:22:04+00:00 urn:sha1:0fdc45a668d95d603a9013f90392f6bc966c72f9 Repoint the import path from git.macaw.me/skunky/devianter, replacing a placeholder v0.0.0 require that had no go.sum entry and did not resolve. v0.3.1 reorders the last two return values of PerformSearch, Group.Get and Group.Gallery from (..., error, Error) to (..., Error, error); adapt the call sites. The two types differ, so the compiler enforces this. 2025-04-07T10:53:47+00:00 lost+skunk me@lost-skunk.cc 2025-04-07T10:53:47+00:00 urn:sha1:210c69e48c2af4d1fdb53c0654ed33a21688696c 2024-09-23T06:38:32+00:00 lost+skunk skunky@ebloid.ru 2024-09-23T06:38:32+00:00 urn:sha1:191984b31ef228c4077904a2831a2af593352670 2024-09-03T12:36:19+00:00 lost+skunk skunky@ebloid.ru 2024-09-03T12:36:19+00:00 urn:sha1:db53a8bd9004098e6a1507e5826a833fd9efa954 2024-08-13T12:59:52+00:00 lost+skunk skunky@ebloid.ru 2024-08-13T12:59:52+00:00 urn:sha1:1537da9b16dfda1ecb2730b5d1de3b9005397618 2024-08-01T19:48:05+00:00 lost+skunk skunky@ebloid.ru 2024-08-01T19:48:05+00:00 urn:sha1:c5514c3875b9b782688047d547dfd6663a5b77bb