kayg/calternal

Watch

Fork 0

Appearance uploads accept oversized and non-image Tus payloads #553

New issue

Closed

opened 2026-09-30 19:19:46 +00:00 by kayg · 4 comments

kayg commented

2026-09-30 19:19:46 +00:00

Owner

Evidence

During the post-merge API-only adversarial run on 2026-09-30, the Appearance upload probes reported:

background 25 MB Tus upload: returned HTTP 201 with an empty response body; the probe expects HTTP 413.
background non-image Tus install: returned HTTP 204 with an empty response body; the probe expects HTTP 400.

The checks are in tests/adversarial/attack.py around lines 1916–1948. This was observed while exercising the merged origin/dev server build. The existing expectations were left unchanged. Please inspect the upload route's size cap for .calternal/backgrounds and its final image-type validation.

## Evidence During the post-merge API-only adversarial run on 2026-09-30, the Appearance upload probes reported: - `background 25 MB Tus upload`: returned HTTP 201 with an empty response body; the probe expects HTTP 413. - `background non-image Tus install`: returned HTTP 204 with an empty response body; the probe expects HTTP 400. The checks are in `tests/adversarial/attack.py` around lines 1916–1948. This was observed while exercising the merged `origin/dev` server build. The existing expectations were left unchanged. Please inspect the upload route's size cap for `.calternal/backgrounds` and its final image-type validation.

kayg referenced this issue

2026-09-30 19:20:03 +00:00

Server aborts during adversarial tag rename API probe #525

kayg referenced this issue

2026-09-30 19:35:39 +00:00

Server aborts during adversarial tag rename API probe #525

kayg commented

2026-09-30 19:52:52 +00:00

Author

Owner

Additional reproduction during the one API-only adversarial round for #421, using the merged local server on job/preview-421: POST /api/v1/files/uploads with a 25 MiB declared .calternal/backgrounds length returned 201, and the four-byte nope PATCH returned 204. The server was still available after these checks. The existing 413 and 400 expectations were unchanged.

Additional reproduction during the one API-only adversarial round for #421, using the merged local server on `job/preview-421`: `POST /api/v1/files/uploads` with a 25 MiB declared `.calternal/backgrounds` length returned 201, and the four-byte `nope` PATCH returned 204. The server was still available after these checks. The existing 413 and 400 expectations were unchanged.

kayg referenced this issue

2026-09-30 20:01:10 +00:00

Calendar preview card: one card (hover), 'Journal' label, Duplicate action; click selects, double-click edits in composer #421

kayg commented

2026-09-30 22:48:25 +00:00

Author

Owner

Fixed in commit 6c4f396e6f675f11bcde3f7b3187cad28490e4c6.

The upload guard checked only Photos/Backgrounds/. DESIGN §35 keeps .calternal/backgrounds/ as the migration source, so direct Tus uploads there also need the 20 MB limit and image decoding check. The Files plugin now guards both paths. The regression test checks an oversized declaration and an invalid image in each path, and confirms that rejected uploads leave no staged row.

Verification after the fix: cargo clippy -p calternal-plugin-files --all-targets -- -D warnings passed; cargo test -p calternal-plugin-files passed with 146 passed, 0 failed, 1 ignored. The full adversarial run used the server binary built before this fix, so its two background failures are the evidence for this change, not a post-fix server result.

Fixed in commit `6c4f396e6f675f11bcde3f7b3187cad28490e4c6`. The upload guard checked only `Photos/Backgrounds/`. DESIGN §35 keeps `.calternal/backgrounds/` as the migration source, so direct Tus uploads there also need the 20 MB limit and image decoding check. The Files plugin now guards both paths. The regression test checks an oversized declaration and an invalid image in each path, and confirms that rejected uploads leave no staged row. Verification after the fix: `cargo clippy -p calternal-plugin-files --all-targets -- -D warnings` passed; `cargo test -p calternal-plugin-files` passed with 146 passed, 0 failed, 1 ignored. The full adversarial run used the server binary built before this fix, so its two background failures are the evidence for this change, not a post-fix server result.

kayg referenced this issue

2026-09-30 23:05:18 +00:00

Log attachments: deleted file still shown, attachments not live, batch send not live, Log order, raw camera names #427

kayg commented

2026-09-30 23:24:50 +00:00

Author

Owner

Reproduced in one real-server ADVERSARIAL_API_ONLY=1 round on 2026-09-30 UTC using the shared release binary: the 25 MiB .calternal/backgrounds Tus create returned 201, and the 4-byte not-image.jpg Tus PATCH returned 204. The server stayed alive. This matches the size/type validation finding already tracked here.

Reproduced in one real-server `ADVERSARIAL_API_ONLY=1` round on 2026-09-30 UTC using the shared release binary: the 25 MiB `.calternal/backgrounds` Tus create returned 201, and the 4-byte `not-image.jpg` Tus PATCH returned 204. The server stayed alive. This matches the size/type validation finding already tracked here.

kayg referenced this issue

2026-09-30 23:33:02 +00:00

Search palette shifts 8 px when results grow (search.mjs 'result growth stays centred' fails) #499

kayg commented

2026-10-01 05:09:05 +00:00

Author

Owner

Fixed on dev in 6c4f396e6f (Validate uploads during legacy background migration).

Fixed on dev in 6c4f396e6f675f11bcde3f7b3187cad28490e4c6 (Validate uploads during legacy background migration).

kayg closed this issue

2026-10-01 05:09:05 +00:00

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

kayg/calternal#553

No description provided.

Rows
Columns