krz/skunky-art

Alternative privacy frontend for DeviantArt.

clone: git clone https://gitbay.org/krz/skunky-art.git

9af155d40accef7aac3ffc6eb960d197798ebd1f

unsigned

author: Christian Cleberg <hello@cleberg.net> · 2026-08-07T23:47:01Z

fix: correct inverted media guard in sendMedia

sendMedia returned when the assembled URL was non-empty — i.e. for every
deviation that actually has media — so the random-media endpoint served
an empty body and never sent the image. For a media-less deviation it
instead fell through to mediaURL[21:] on an empty string, panicking in
proxy mode. Guard on len == 0 so real media is sent and absent media is
a no-op.

 app/api.go      |  2 +-
 app/api_test.go | 59 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 60 insertions(+), 1 deletion(-)

diff --git a/app/api.go b/app/api.go
index 5b23668..c89f10d 100755
--- a/app/api.go
+++ b/app/api.go
@@ -46,7 +46,7 @@ func (a API) Error(description string, status int) {
 func (a API) sendMedia(d *devianter.Deviation) {
 	mediaURL, name := devianter.UrlFromMedia(d.Media)
 	a.main.SetFilename(name)
-	if len(mediaURL) != 0 {
+	if len(mediaURL) == 0 {
 		return
 	}
 
diff --git a/app/api_test.go b/app/api_test.go
new file mode 100644
index 0000000..9584e40
--- /dev/null
+++ b/app/api_test.go
@@ -0,0 +1,59 @@
+package app
+
+import (
+	"net/http/httptest"
+	"testing"
+
+	"github.com/krazywarez/devianter"
+)
+
+// fullviewDeviation returns a deviation whose media assembles into a non-empty
+// wixmp URL, i.e. one that sendMedia is meant to serve.
+func fullviewDeviation() *devianter.Deviation {
+	d := &devianter.Deviation{}
+	d.Media.BaseUri = "https://images-wixmp-abc.wixmp.com/f/u/x.png"
+	d.Media.Name = "x"
+	d.Media.Types = append(d.Media.Types, struct {
+		T    string
+		H, W int
+	}{T: "fullview", H: 1920, W: 1280})
+	return d
+}
+
+// TestSendMediaServesRealMedia is the regression test for the inverted guard: a
+// deviation that has media must be sent, not dropped. In non-proxy mode that is
+// a 302 to the wixmp URL; the pre-fix guard returned before writing anything.
+func TestSendMediaServesRealMedia(t *testing.T) {
+	proxy := CFG.Proxy
+	CFG.Proxy = false
+	defer func() { CFG.Proxy = proxy }()
+
+	w := httptest.NewRecorder()
+	API{main: &skunkyart{Writer: w}}.sendMedia(fullviewDeviation())
+
+	if w.Code != 302 {
+		t.Errorf("status is %d, want a 302 redirect to the media", w.Code)
+	}
+	if w.Header().Get("Location") == "" {
+		t.Error("no Location header set — the media was dropped")
+	}
+}
+
+// TestSendMediaIgnoresEmptyMedia pins the other half of the bug: a deviation
+// with no media must be a no-op. With proxy on, the pre-fix code fell through to
+// mediaURL[21:] on an empty string and panicked.
+func TestSendMediaIgnoresEmptyMedia(t *testing.T) {
+	proxy := CFG.Proxy
+	CFG.Proxy = true
+	defer func() { CFG.Proxy = proxy }()
+
+	w := httptest.NewRecorder()
+	API{main: &skunkyart{Writer: w}}.sendMedia(&devianter.Deviation{})
+
+	if w.Code != 200 {
+		t.Errorf("status is %d, want nothing written (recorder default 200)", w.Code)
+	}
+	if loc := w.Header().Get("Location"); loc != "" {
+		t.Errorf("Location %q set for a media-less deviation, want none", loc)
+	}
+}