From 83d9cd0b7a3e0ec6beb5c889102211567a6db03f Mon Sep 17 00:00:00 2001 From: Christian Cleberg Date: Wed, 15 Jul 2026 03:17:09 -0500 Subject: fix: serve media again by unsetting download-proxy and scoping Host per request MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two independent faults made every image fail while pages still rendered. config.example.json shipped download-proxy=http://127.0.0.1:8080. Only media fetches go through that proxy — pages reach DeviantArt via devianter on the default transport — so when nothing listens there, images 502 and the rest of the page looks fine. In a scratch container 127.0.0.1 is the container itself, so the default could never work under Docker. Unset it and document that it must stay empty unless an operator really runs a proxy. Host was a package global reassigned by every request, so a concurrent request could overwrite it mid-render and emit URLs on another origin's host and port. The instance's own default-src 'self' CSP then blocked those images. Thread the request's host through skunkyart instead, and take it as an explicit argument in URLBuilder, ParseMedia, ParseDescription, BuildUserPlate and ConvertDeviantArtURLToSkunkyArt. Feeds keep their absolute URLs. Also start RefreshInstances after ExecuteConfig rather than before it: the goroutine read CFG while json.Unmarshal was writing it (a race the detector flags), and its fetch escaped both the throttle and the configured User-Agent. Verified: 300 concurrent requests with distinct Host headers now round-trip their own host (was 1 leak per 300), go test -race is clean, and cache+proxy both enabled serves 200 image/jpeg cold and from cache. --- app/wrapper.go | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) (limited to 'app/wrapper.go') diff --git a/app/wrapper.go b/app/wrapper.go index 7b4fe89..7465062 100755 --- a/app/wrapper.go +++ b/app/wrapper.go @@ -42,12 +42,12 @@ func (s skunkyart) GRUser() { var about = &x.ModuleData.GroupAbout group.Group = true group.CreationDate = x.ModuleData.GroupAbout.FoundatedAt.UTC().String() - group.About.DescriptionFormatted = ParseDescription(about.Description) + group.About.DescriptionFormatted = ParseDescription(s.Host, about.Description) } else if false { group.About.A = x.ModuleData.About var about = &group.About.A group.CreationDate = time.Unix(time.Now().Unix()-x.ModuleData.About.RegDate, 0).UTC().String() - group.About.DescriptionFormatted = ParseDescription(about.Description) + group.About.DescriptionFormatted = ParseDescription(s.Host, about.Description) for _, val := range x.ModuleData.About.SocialLinks { var social strings.Builder @@ -72,12 +72,12 @@ func (s skunkyart) GRUser() { case "cover_deviation": group.About.BGMeta = x.ModuleData.CoverDeviation.Deviation - group.About.BGMeta.Url = ConvertDeviantArtURLToSkunkyArt(group.About.BGMeta.Url) - group.About.BG = ParseMedia(group.About.BGMeta.Media) + group.About.BGMeta.Url = ConvertDeviantArtURLToSkunkyArt(s.Host, group.About.BGMeta.Url) + group.About.BG = ParseMedia(s.Host, group.About.BGMeta.Media) case "group_admins": var htm strings.Builder for _, z := range x.ModuleData.GroupAdmins.Results { - htm.WriteString(BuildUserPlate(z.User.Username)) + htm.WriteString(BuildUserPlate(s.Host, z.User.Username)) } group.Admins += htm.String() } @@ -124,9 +124,9 @@ func (s skunkyart) GRUser() { if !x.Thumb.NSFW || CFG.Nsfw { folders.WriteString(``) @@ -191,7 +191,7 @@ func (s skunkyart) Deviation(author, postname string) { if post.Post.Deviation.NSFW && !CFG.Nsfw { s.Writer.WriteHeader(403) wr(s.Writer, `

NSFW content are disabled on this instance.

`) return } @@ -201,9 +201,9 @@ func (s skunkyart) Deviation(author, postname string) { } if post.Post.Deviation.TextContent.Excerpt != "" { - post.Post.Description = ParseDescription(post.Post.Deviation.TextContent) + post.Post.Description = ParseDescription(s.Host, post.Post.Deviation.TextContent) } else { - post.Post.Description = ParseDescription(post.Post.Deviation.Extended.DescriptionText) + post.Post.Description = ParseDescription(s.Host, post.Post.Deviation.Extended.DescriptionText) } for _, x := range post.Post.Deviation.Extended.RelatedContent { @@ -216,7 +216,7 @@ func (s skunkyart) Deviation(author, postname string) { for _, x := range post.Post.Deviation.Extended.Tags { var tag strings.Builder tag.WriteString(` #`) tag.WriteString(x.Name) tag.WriteString("") @@ -226,7 +226,7 @@ func (s skunkyart) Deviation(author, postname string) { post.Comments = s.ParseComments(devianter.GetComments(id, post.Post.Comments.Cursor, s.Page, 1)) post.StringTime = post.Post.Deviation.PublishedTime.UTC().String() - post.Post.IMG = ParseMedia(post.Post.Deviation.Media) + post.Post.IMG = ParseMedia(s.Host, post.Post.Deviation.Media) s.ExecuteTemplate("deviantion.htm", "html", &s) } @@ -312,7 +312,7 @@ func (s skunkyart) Search() { if l := len(usernames); l != 0 { ss.List += `
` for x := range len(usernames) { - ss.List += BuildUserPlate(usernames[x]) + ss.List += BuildUserPlate(s.Host, usernames[x]) } ss.List += `
` ss.List += s.NavBase(DeviationList{ -- cgit v1.2.3