MHSanaei cea69a4117 fix(api): accept config envelopes only on requests that carry a body ...

The envelope middleware buffered and decoded any request carrying its
headers, GETs included, which the router-wide body cap skips and which
read-only tokens may call; its raw read had no cap of its own. Refuse an
envelope on safe methods and read at most the decoded-size limit.

2026-10-31 09:09:06 +00:00

..

bodylimit_test.go

fix(web): tighten database restore body-cap exemption (#5609)

2026-06-28 15:00:55 +02:00

bodylimit.go

fix(web): tighten database restore body-cap exemption (#5609)

2026-06-28 15:00:55 +02:00

config_envelope_test.go

fix(api): accept config envelopes only on requests that carry a body

2026-10-31 09:09:06 +00:00

config_envelope.go

fix(api): accept config envelopes only on requests that carry a body

2026-10-31 09:09:06 +00:00

domainValidator.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

security_test.go

fix(middleware): log rejected CSRF requests with the trusted client address (#6692)

2026-10-24 04:51:21 +02:00

security.go

fix(middleware): log rejected CSRF requests with the trusted client address (#6692)

2026-10-24 04:51:21 +02:00

validate_mutation_test.go

Test-quality audit: fix 2 prod bugs, strengthen weak tests, add mutation/fuzz/CI tooling (#5345)

2026-06-15 15:17:03 +02:00

validate_protocol_test.go

fix(inbounds): accept masque in the inbound protocol validator

2026-10-11 10:56:47 +02:00

validate_test.go

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

validate.go

refactor(frontend): move form-item hints from extra to tooltip

2026-06-17 17:24:16 +02:00