Bohan Jiang f08b2b4f50 fix(attachments): harden local sidecar serving and tighten Upload gate (#2459) ...

Follow-ups to #2444:

- ServeFile refuses keys ending in .meta.json so the sidecar JSON isn't
  a stable read API. Sits before any disk work so a crafted
  .meta.json sibling can't trigger an out-of-tree read.
- ServeFile rejects paths that resolve outside uploadDir (via
  filepath.Rel) before readLocalMeta runs. http.ServeFile's own ..
  guard fires later on r.URL.Path, but readLocalMeta would otherwise
  do a stray disk read on <some-path>.meta.json before the 400 lands.
- Upload only writes a sidecar when filename is non-empty. ServeFile
  only reads the filename anyway, so a content-type-only sidecar was
  dead disk weight.
- Drop the dead json.Marshal error branch — marshaling two strings
  cannot fail.

Three new tests cover sidecar suffix rejection, the traversal guard,
and the no-filename Upload short-circuit.

Co-authored-by: multica-agent <github@multica.ai>

2026-05-12 12:49:22 +08:00

..

local_test.go

fix(attachments): harden local sidecar serving and tighten Upload gate (#2459)

2026-05-12 12:49:22 +08:00

local.go

fix(attachments): harden local sidecar serving and tighten Upload gate (#2459)

2026-05-12 12:49:22 +08:00

s3_test.go

fix(storage): build region-qualified S3 public URLs (#2051) (#2065)

2026-05-06 12:45:55 +08:00

s3.go

fix(storage): build region-qualified S3 public URLs (#2051) (#2065)

2026-05-06 12:45:55 +08:00

storage.go

…

util.go

…