Cybersecurity-Projects/PROJECTS/beginner/canary-token-generator/backend/internal/token/generators
CarterPerez-dev 30ebda39d5 fix(canary): PDF trigger URL uses ?p= query pad; handler trims trailing _
Audit F2: the PDF placeholder was padded with underscores embedded directly
in the /URI path, so Acrobat fetched /c/<id>____________ and the chi route
extracted the padded id. Lookup returned ErrNotFound, the webbug fallback
served a 1x1 GIF, and event recording skipped because tok was nil. PDF
tokens silently never recorded events.

Part B (durable): pad inside a ?p= query string so the trigger path stays
canonical and chi extracts the real id. Part A (defense in depth): handler
TrimRight on _ so PDFs already in the field also resolve correctly. Added
two regression tests: byte-after-id assertion in the PDF artifact, and the
handler's trim path.
2026-05-17 19:07:50 -04:00
..
docx refactor(canary): consolidate realIP into middleware across 5 generators 2026-05-14 00:31:49 -04:00
envfile refactor(canary): consolidate realIP into middleware across 5 generators 2026-05-14 00:31:49 -04:00
kubeconfig refactor(canary): consolidate realIP into middleware across 5 generators 2026-05-14 00:31:49 -04:00
mysql feat(canary): mysql generator + register in registry 2026-05-13 14:55:37 -04:00
pdf fix(canary): PDF trigger URL uses ?p= query pad; handler trims trailing _ 2026-05-17 19:07:50 -04:00
pixel fix(canary-phase2): address audit findings before rollup 2026-05-12 02:56:29 -04:00
registry fix(canary-phase9): plumb mysql public host/port through to generator 2026-05-13 15:27:21 -04:00
slowredirect refactor(canary): consolidate realIP into middleware across 5 generators 2026-05-14 00:31:49 -04:00
webbug feat(canary): full wire-up + webbug refactor + mysql goroutine 2026-05-13 15:20:01 -04:00
generator.go feat(canary): token service + contract relocation 2026-05-13 15:13:43 -04:00