fix: don't read Cloudflare's injected jsd script as a refusal #109

Merged
sulthan merged 1 commits from fix/demonic-interstitial-false-positive into main 2026-08-16 21:17:30 +07:00
Owner

demonic Lanes were parking in the 15m refusal backoff while plain TLS returned the full series page. Cloudflare injects /cdn-cgi/challenge-platform/scripts/jsd/main.js into ordinary 200 pages once a zone turns JS detections on (demonic did, 2026-08-16), and isInterstitial matched the bare prefix.

Now matches the challenge orchestration path /cdn-cgi/challenge-platform/h/, which only the interstitial serves. Regression test TestIsInterstitial: challenge fixture still detected, jsd-injected page not, and its chapter still parses. go test ./internal/latest green.

Live proof: curl of https://demonicscans.org/manga/The-Possessed-Grappler -> 200, 133080 bytes, real title, 22 chaptered.php anchors, one jsd script, no orchestrate path.

demonic Lanes were parking in the 15m refusal backoff while plain TLS returned the full series page. Cloudflare injects `/cdn-cgi/challenge-platform/scripts/jsd/main.js` into ordinary 200 pages once a zone turns JS detections on (demonic did, 2026-08-16), and `isInterstitial` matched the bare prefix. Now matches the challenge orchestration path `/cdn-cgi/challenge-platform/h/`, which only the interstitial serves. Regression test `TestIsInterstitial`: challenge fixture still detected, jsd-injected page not, and its chapter still parses. `go test ./internal/latest` green. Live proof: `curl` of https://demonicscans.org/manga/The-Possessed-Grappler -> 200, 133080 bytes, real title, 22 `chaptered.php` anchors, one jsd script, no orchestrate path.
sulthan added 1 commit 2026-08-16 21:17:21 +07:00
demonicscans.org turned JS detections on, so Cloudflare began injecting
/cdn-cgi/challenge-platform/scripts/jsd/main.js into ordinary 200 pages.
isInterstitial matched the bare /cdn-cgi/challenge-platform/ prefix, so
every real demonic series page became errChallengeHeld: two per pass
parked the Lane in the 15m refusal backoff while plain TLS was in fact
returning the full page (200, 133KB, 22 chapter anchors, verified live
2026-08-16).

Match the challenge orchestration path /cdn-cgi/challenge-platform/h/
instead — served only by the interstitial itself, stable across its
wording and locale.
sulthan merged commit 20fff588cc into main 2026-08-16 21:17:30 +07:00
Sign in to join this conversation.