handleRaw only streams the blob for image mimes (#221 path); for other attachment mimes it falls through to empty row.Content and serves 0 bytes. Repro: curl https://palette-dev.archfox.org/raw/<non-image-attachment-id> | wc -c -> 0 (image control paste streams correctly).
Definition of done: /raw streams the attachment blob with the sniffed mime for ALL attachment mimes; regression test per the attachment QA recipe (multipart create, size + Content-Type + byte equality).
Found in v0.5.0 pre-release pentest.
handleRaw only streams the blob for image mimes (#221 path); for other attachment mimes it falls through to empty row.Content and serves 0 bytes. Repro: `curl https://palette-dev.archfox.org/raw/<non-image-attachment-id> | wc -c` -> 0 (image control paste streams correctly).
Definition of done: /raw streams the attachment blob with the sniffed mime for ALL attachment mimes; regression test per the attachment QA recipe (multipart create, size + Content-Type + byte equality).
fen
added the In Progress label 2026-09-18 01:26:17 +00:00
fen
added spent time 1 minute2026-09-18 01:26:17 +00:00
QA PASS (fix attempt 1). Merged PR #286 and deployed to palette-dev.
Evidence (live, post-rollout):
text/plain attachment: GET /raw/ddngmc -> 200, Content-Type "text/plain; charset=utf-8", 42 bytes, sha256 matches the uploaded file exactly (was 0 bytes before the fix).
image regression: /raw of a PNG attachment streams image/png with byte-identical content (sha256 match) per the #221 path.
active-content rule intact: /raw of an .svg attachment is forced to text/plain, body served verbatim.
go build + internal/api tests pass on the fix branch; CI green on merge commit; pod image freshly pulled (pullPolicy Always).
QA PASS (fix attempt 1). Merged PR #286 and deployed to palette-dev.
Evidence (live, post-rollout):
- text/plain attachment: GET /raw/ddngmc -> 200, Content-Type "text/plain; charset=utf-8", 42 bytes, sha256 matches the uploaded file exactly (was 0 bytes before the fix).
- image regression: /raw of a PNG attachment streams image/png with byte-identical content (sha256 match) per the #221 path.
- active-content rule intact: /raw of an .svg attachment is forced to text/plain, body served verbatim.
- go build + internal/api tests pass on the fix branch; CI green on merge commit; pod image freshly pulled (pullPolicy Always).
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Found in v0.5.0 pre-release pentest.
handleRaw only streams the blob for image mimes (#221 path); for other attachment mimes it falls through to empty row.Content and serves 0 bytes. Repro:
curl https://palette-dev.archfox.org/raw/<non-image-attachment-id> | wc -c-> 0 (image control paste streams correctly).Definition of done: /raw streams the attachment blob with the sniffed mime for ALL attachment mimes; regression test per the attachment QA recipe (multipart create, size + Content-Type + byte equality).
QA PASS (fix attempt 1). Merged PR #286 and deployed to palette-dev.
Evidence (live, post-rollout):