sulthan/mangaBookmark
1
0
Fork 0
Code Issues 4 Pull Requests Actions Packages Projects Releases Wiki Activity

Add gated cover byte fetcher #66

Merged
sulthan merged 1 commits from issue-57-cover-fetch-gate into main 2026-08-10 00:45:56 +07:00
Conversation 0 Commits 1 Files Changed 8
+559 -25
sulthan commented 2026-08-10 00:36:45 +07:00
Owner
Copy Link
Copy Source

Summary

Adds a plain-TLS cover byte fetcher with a destination-class SSRF gate and wires public cover sources through the content-addressed filesystem store.

Changes

  • Resolve hostnames before connecting; refuse non-HTTPS, loopback, private, link-local, unique-local, CGNAT, credentials, and mixed public/private DNS answers.
  • Re-check every redirect and resolve/classify again at dial time to close DNS rebinding.
  • Reuse maxBodyBytes; reject oversized responses and non-image content types before persistence.
  • Add generic Store.GetCover/PutCover source-URL storage while preserving the browser-backed kagane path.
  • Keep cover prefetch failures isolated from chapter polling.
  • Add observable tests for TLS, no-connection refusals, all refused address classes, redirect blocking, streaming body caps, non-image rejection, content-addressed persistence, DNS rebinding, and poller routing.

Verification

  • go test -count=1 ./...
  • go vet ./...

Both pass. No test touches the live network.

Closes #57

## Summary Adds a plain-TLS cover byte fetcher with a destination-class SSRF gate and wires public cover sources through the content-addressed filesystem store. ## Changes - Resolve hostnames before connecting; refuse non-HTTPS, loopback, private, link-local, unique-local, CGNAT, credentials, and mixed public/private DNS answers. - Re-check every redirect and resolve/classify again at dial time to close DNS rebinding. - Reuse `maxBodyBytes`; reject oversized responses and non-image content types before persistence. - Add generic `Store.GetCover`/`PutCover` source-URL storage while preserving the browser-backed kagane path. - Keep cover prefetch failures isolated from chapter polling. - Add observable tests for TLS, no-connection refusals, all refused address classes, redirect blocking, streaming body caps, non-image rejection, content-addressed persistence, DNS rebinding, and poller routing. ## Verification - `go test -count=1 ./...` - `go vet ./...` Both pass. No test touches the live network. Closes #57
sulthan added 1 commit 2026-08-10 00:36:46 +07:00
Add gated cover byte fetcher cf06801bc5
sulthan merged commit 9d6d3bde72 into main 2026-08-10 00:45:56 +07:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Something is broken
 enhancement
New feature or improvement
 needs-info
Waiting on reporter for more information
 needs-triage
Maintainer needs to evaluate
 ready-for-agent
Fully specified, ready for an AFK agent
 ready-for-human
Needs human implementation
 wayfinder:grilling
wayfinder:map
wayfinder:prototype
wayfinder:research
wontfix
Will not be actioned
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
sulthan
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sulthan/mangaBookmark#66
Delete Branch "issue-57-cover-fetch-gate"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?