全量修复/补测试+UED改进 - #535

Merged

vastsa merged 31 commits into

vastsa:masterfrom

Marrrrrrrrry:fix/m0-stop-bleeding

Sep 19, 2026

Commits on Sep 18, 2026

fix: constant-time comparison for download tokens (security item 5)
Marrrrrrrrry
committed
644b106
fix: single source for attachment headers + guard tests (security item 2)
Marrrrrrrrry
committed
014cd90
fix: reject internal-network endpoints for storage config (security item 7)
Marrrrrrrrry
committed
9d5fa57
fix: JSON 404 for handler-raised 404s; negative-path test batch
Marrrrrrrrry
committed
3b5e25a
fix: run container as non-root app user with compat volume chown (security item 3)
Marrrrrrrrry
committed
b551b6a
fix: compare download tokens as bytes (non-ASCII key caused 500)
Marrrrrrrrry
committed
db1a39b
test: lock changed-only semantics for endpoint config saves
Marrrrrrrrry
committed
c1f0abc
fix: resolve-based SSRF check — deny IP shorthands, hex/decimal IPs, DNS maps
Marrrrrrrrry
committed
3addb41
test: pin 404 handler dual-branch behavior (browser theme page vs API JSON)
Marrrrrrrrry
committed
2182091
fix: write back normalized endpoint values; hostname dev-gate test
Marrrrrrrrry
committed
bc51a78
test: header-injection negative paths for attachment disposition
Marrrrrrrrry
committed
c4b5b26
fix: S3 merge buffers parts to >=5MiB; missing object 404 upfront
Marrrrrrrrry
committed
258a19e
test: S3 backend coverage via in-process moto server (13 cases)
Marrrrrrrrry
committed
3dafe21
fix: WebDAV missing object 404 upfront; connection errors map to 503
Marrrrrrrrry
committed
dc56f27
test: WebDAV backend coverage via in-process WebDAV server (9 cases)
Marrrrrrrrry
committed
65b3575
fix: OneDrive missing object maps to 404 upfront; OpenDAL behavior pinned
Marrrrrrrrry
committed
bd05cbc
test: admin write-path coverage (batch/single delete, batch update, policy actions)
Marrrrrrrrry
committed
c23b6d6
test: admin read-path and view-preset CRUD coverage (22 cases)
Marrrrrrrrry
committed
12dba9d
refactor: move auth primitives to apps/base/auth, kill base->admin dep
Marrrrrrrrry
committed
0d524ee
refactor: split admin services god-module (ConfigService/LocalFile out)
Marrrrrrrrry
committed
b3f1d7f
fix: size-less uploads no longer crash (upstream seek bug)
Marrrrrrrrry
committed
f9e29dd
chore: bump direct deps (patch/minor)
Marrrrrrrrry
committed
b1e24ef
ci: gradual mypy adoption via baseline ratchet
Marrrrrrrrry
committed
fc20567
fix: migrate WebDAV auth off aiohttp.BasicAuth (deprecated in 4.0)
Marrrrrrrrry
committed
d0046c8
chore: drop dead code (WebDAV _instance stub, unused LocalFileClass.write)
Marrrrrrrrry
committed
4fde3ef
test: file-validation negative paths (13 cases)
Marrrrrrrrry
committed
fa4f5f0
test: migration runner coverage (5 cases)
Marrrrrrrrry
committed
a12c256
refactor: split core/storage.py into a package (per-backend modules)
Marrrrrrrrry
committed
1640823
refactor: TypedDict for IPRateLimit records
Marrrrrrrrry
committed
22a3285
chore: tighten mypy baseline after IPRateLimit TypedDict
Marrrrrrrrry
committed
915566d

Commits on Sep 19, 2026

refactor: resolve all 26 baseline mypy errors; precise test assertions
Marrrrrrrrry
committed
1bfcdca

Navigation Menu

全量修复/补测试+UED改进 - #535

全量修复/补测试+UED改进#535
vastsa merged 31 commits into
vastsa:masterfrom
Marrrrrrrrry:fix/m0-stop-bleeding

Commits on Sep 18, 2026

fix: constant-time comparison for download tokens (security item 5)

fix: single source for attachment headers + guard tests (security item 2)

fix: reject internal-network endpoints for storage config (security item 7)

fix: JSON 404 for handler-raised 404s; negative-path test batch

fix: run container as non-root app user with compat volume chown (security item 3)

fix: compare download tokens as bytes (non-ASCII key caused 500)

test: lock changed-only semantics for endpoint config saves

fix: resolve-based SSRF check — deny IP shorthands, hex/decimal IPs, DNS maps

test: pin 404 handler dual-branch behavior (browser theme page vs API JSON)

fix: write back normalized endpoint values; hostname dev-gate test

test: header-injection negative paths for attachment disposition

fix: S3 merge buffers parts to >=5MiB; missing object 404 upfront

test: S3 backend coverage via in-process moto server (13 cases)

fix: WebDAV missing object 404 upfront; connection errors map to 503

test: WebDAV backend coverage via in-process WebDAV server (9 cases)

fix: OneDrive missing object maps to 404 upfront; OpenDAL behavior pinned

test: admin write-path coverage (batch/single delete, batch update, policy actions)

test: admin read-path and view-preset CRUD coverage (22 cases)

refactor: move auth primitives to apps/base/auth, kill base->admin dep

refactor: split admin services god-module (ConfigService/LocalFile out)

fix: size-less uploads no longer crash (upstream seek bug)

chore: bump direct deps (patch/minor)

ci: gradual mypy adoption via baseline ratchet

fix: migrate WebDAV auth off aiohttp.BasicAuth (deprecated in 4.0)

chore: drop dead code (WebDAV _instance stub, unused LocalFileClass.write)

test: file-validation negative paths (13 cases)

test: migration runner coverage (5 cases)

refactor: split core/storage.py into a package (per-backend modules)

refactor: TypedDict for IPRateLimit records

chore: tighten mypy baseline after IPRateLimit TypedDict

Commits on Sep 19, 2026

refactor: resolve all 26 baseline mypy errors; precise test assertions