Cybersecurity-Projects/PROJECTS/beginner/canary-token-generator/backend/internal
CarterPerez-dev 30ebda39d5 fix(canary): PDF trigger URL uses ?p= query pad; handler trims trailing _
Audit F2: the PDF placeholder was padded with underscores embedded directly
in the /URI path, so Acrobat fetched /c/<id>____________ and the chi route
extracted the padded id. Lookup returned ErrNotFound, the webbug fallback
served a 1x1 GIF, and event recording skipped because tok was nil. PDF
tokens silently never recorded events.

Part B (durable): pad inside a ?p= query string so the trigger path stays
canonical and chi extracts the real id. Part A (defense in depth): handler
TrimRight on _ so PDFs already in the field also resolve correctly. Added
two regression tests: byte-after-id assertion in the PDF artifact, and the
handler's trim path.
2026-05-17 19:07:50 -04:00
..
admin fix(canary-phase12): address audit findings before phase rollup 2026-05-14 07:02:39 -04:00
config fix(canary): dev nginx routes /c/, /k/, /api/ to canary + manage_url defaults to base_url 2026-05-17 18:12:09 -04:00
core fix(canary): replace //nolint pragmas with explicit error handling 2026-05-13 13:28:44 -04:00
event feat(canary): Event.AttachGeoIP + event.Service geo enrichment 2026-05-17 05:24:17 -04:00
geoip fix(canary-phase13): direct unit coverage for firstSubdivisionName 2026-05-17 05:30:13 -04:00
health fix(canary): replace //nolint pragmas with explicit error handling 2026-05-13 13:28:44 -04:00
middleware fix(canary): CSP allows challenges.cloudflare.com for Turnstile 2026-05-17 19:07:41 -04:00
notify fix(canary-phase10): escape geo wrapping parens for MarkdownV2 before rollup 2026-05-14 00:47:08 -04:00
server fix(canary-phase1): clear all post-phase-1 audit observations + header normalization 2026-05-10 06:15:26 -04:00
testutil fix(canary): clear pre-audit lint debt + migrate golangci config to v2 2026-05-12 02:49:56 -04:00
token fix(canary): PDF trigger URL uses ?p= query pad; handler trims trailing _ 2026-05-17 19:07:50 -04:00
turnstile feat(canary): turnstile verifier + middleware 2026-05-13 15:08:37 -04:00