| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Correctness and security findings surfaced by golangci-lint, plus two
latent panics found alongside them.
- router: http.ListenAndServe has no timeouts at all (gosec G114), so a
slow client could hold a connection and its handler open indefinitely.
Replace it with an explicit http.Server carrying read/write/idle
timeouts.
- httpclient: InstallDAThrottle asserted http.DefaultTransport was a
*http.Transport and would panic outright if anything had already
wrapped it -- which is precisely what that function does. Check the
assertion and fall back to a fresh transport. Expose ProxiedTransport
so a configured download-proxy can inherit the same throttle and
timeouts instead of silently bypassing them.
- cache: the Sys() assertion to *syscall.Stat_t is only valid on unix and
would panic elsewhere; skip rotation instead. Indexing
Headers["Content-Type"][0] panics when the header is absent; use
Headers.Get. Cache files are written 0600 rather than 0700, as they are
never executed.
- cli, api: check error returns, and exit rather than nil-dereference a
file handle that failed to open.
SHA-1 and math/rand keep //nolint:gosec with reasons: they are cache-key
hashes and random-artwork picks, not security primitives.
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Three bugs in Random():
- The retry loop was unbounded. Only the NSFW path incremented attempt,
so a run of DeviantArt errors span forever, hammering the API and
risking an egress-IP ban.
- string(rand.Intn(999)) converts a rune, not a number: string(65) is
"A", not "65". Searches were querying garbage. Use strconv.Itoa.
- rand.Intn panics on 0, so an empty result set crashed the handler.
Skip empty results.
The exhausted-retries error now fires when the loop ends rather than
falling through to index an empty slice.
|
| |
|
|
|
|
|
|
|
|
| |
Repoint the import path from git.macaw.me/skunky/devianter, replacing a
placeholder v0.0.0 require that had no go.sum entry and did not resolve.
v0.3.1 reorders the last two return values of PerformSearch, Group.Get
and Group.Gallery from (..., error, Error) to (..., Error, error);
adapt the call sites. The two types differ, so the compiler enforces
this.
|
| | |
|
| |
|
|
| |
улучшения ксс, фикс нсфв, фикс максимального размера кеша
|
| | |
|
| | |
|
| | |
|
| |
|
