Repository navigation

feat(backend): refuse $-prefixed keys in request query strings and bodies - #2322

Merged

lilyshen0722 merged 8 commits into

mainfrom

sre-c1-dollar-key-guard

Oct 25, 2026

Merged

feat(backend): refuse $-prefixed keys in request query strings and bodies#2322
lilyshen0722 merged 8 commits into
mainfrom
sre-c1-dollar-key-guard

Commits on Oct 25, 2026
- feat(backend): refuse $-prefixed keys in request query strings and bodies
  
  lilyshen0722
  and
  claude
  committed
  4e920fe
- perf(backend): walk request keys in one linear pass, with depth and key caps
  
  lilyshen0722
  and
  claude
  committed
  e7bad85
- test(backend): keep the deep-body check independent of the JSON parser
  
  lilyshen0722
  and
  claude
  committed
  9609873
- refactor(backend): one key list for arrays and objects in the key walk
  
  lilyshen0722
  and
  claude
  committed
  6f09d0b
- fix(backend): bound sparse arrays by length; rate-limit external-link creation
  
  lilyshen0722
  and
  claude
  committed
  f345b24
- fix(backend): remove a stored upload when the key guard refuses the request
  
  lilyshen0722
  and
  claude
  committed
  27cb929
- fix(backend): remove refused uploads only inside uploads/
  
  lilyshen0722
  and
  claude
  committed
  ea14a10
- fix($-key guard): cover the OAuth start form and literal query keys
  
  lilyshen0722
  and
  claude
  committed
  51e90c9