H1K0 3b79f12ec0 fix(backend): bound image decode and ffmpeg during thumbnailing ...

Thumbnail/preview generation decoded untrusted images with no size limit
(a decompression bomb could exhaust memory) and ran ffmpeg with no
timeout (a malformed video could hang the request). Image dimensions are
now checked via image.DecodeConfig before the raster is allocated and
rejected above 64 Mpx, and ffmpeg runs under a 30s timeout.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-10 14:11:31 +03:00

..

cmd/server

fix(backend): make access tokens revocable via session validation

2026-06-10 14:09:25 +03:00

internal

fix(backend): bound image decode and ffmpeg during thumbnailing

2026-06-10 14:11:31 +03:00

migrations

fix(backend): bootstrap admin from env instead of seeding admin/admin

2026-06-10 14:01:48 +03:00

go.mod

feat(backend): add integration tests with testcontainers-go

2026-04-05 02:34:16 +03:00

go.sum

feat(backend): add integration tests with testcontainers-go

2026-04-05 02:34:16 +03:00