Codeman

mirror of https://github.com/Ark0N/Codeman.git synced 2026-10-02 21:49:42 +02:00

Files

T

Codeman maintainer b7ff54b2ec fix: file viewer opens audio/svg/binary like the attachments viewer

The File Browser preview and Attachments preview share openFilePreview(),
but the workspace branch (via /file-content) misclassified several types the
attachments viewer handled fine:

- SVG was reported as type:image, but file-raw serves SVG as octet-stream +
  attachment (XSS hardening), so the <img> broke. Now fetched and rendered via
  a same-origin image/svg+xml blob <img> (safe; <img> never runs SVG scripts).
  file-raw's SVG hardening is unchanged.
- Audio (mp3/wav/ogg/m4a/aac/flac/opus) was type:binary -> "Cannot preview".
  Now classified as audio and rendered with <audio controls>; file-raw gained
  the matching audio/video MIME types so playback works.
- Binary formats not in the hardcoded list (xlsx/doc/zip/...) were decoded as
  UTF-8 and dumped as mojibake. Replaced the static list with a NUL-byte
  content sniff that flags arbitrary binaries; the binary fallback now offers a
  Download link instead of dead-ending.

Adds route tests for audio, known-binary (xlsx), and NUL-sniff classification.
Verified end-to-end on an isolated instance + headless browser.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-15 00:42:12 +02:00

_route-test-utils.ts

test: repair route harness error rendering + stop AI-checker spawning real processes in tests (#97 )

2026-05-25 23:55:57 +02:00

case-routes.test.ts

feat(api): establish stable HTTP contract — uniform {success,data} envelope, status codes, /api/v1

2026-06-10 01:30:43 +02:00

file-routes-attachment-path-guard.test.ts

fix(attachments): harden registry + close magic-link injection vector

2026-06-11 10:27:09 +02:00

file-routes-preview-thumbnail.test.ts

fix(attachments): harden document preview/thumbnail path (review of #120 )