rays/ipx
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 18 Wiki Activity

Download addresses lose their query before they go out (#292)

Browse Source 
Progress and DownloadDone went to every open page and the log with the
file's whole address; a Patreon file's carries its signature. Seen in
production's log for gcn-news-minute.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Ray Slakinski
2026-10-19 18:12:48 +00:00
parent 4c1b78408f
commit c1d8983ca1
1 changed files with 21 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
crates/ipx/src/ipc.rs
View File

@@ -236,7 +236,10 @@ impl Event {
*url = redact(url);
*msg = redact_text(msg);
}
Event::TorrentDeferred { url, .. } => *url = redact(url),
// Progress and DownloadDone too: a Patreon file's address carries its signature (#292).
Event::TorrentDeferred { url, .. } | Event::Progress { url, .. } | Event::DownloadDone { url, .. } => {
*url = redact(url)
}
Event::FeedMoved { from, to, .. } => {
*from = redact(from);
*to = redact(to);
@@ -486,8 +489,23 @@ mod tests {
from: format!("https://x/rss?{key}"),
to: format!("https://y/rss?{key}"),
});
// What every open page is sent, whoever's feed it is (#238).
for _ in 0..3 {
out.emit(Event::Progress {
feed: "f".into(),
enclosure: 1,
url: format!("https://cdn/ep.mp3?{key}"),
file: "ep.mp3".into(),
done: 1,
total: None,
});
out.emit(Event::DownloadDone {
feed: "f".into(),
enclosure: 1,
url: format!("https://cdn/ep.mp3?{key}"),
path: "/downloads/ep.mp3".into(),
bytes: 1,
});
// What every open page is sent, whoever's feed it is (#238, #292).
for _ in 0..5 {
let sent = serde_json::to_string(&rx.try_recv().unwrap()).unwrap();
assert!(!sent.contains("SECRET"), "{sent}");
assert!(sent.contains("https://"), "the address is still there, without its key: {sent}");