web/src/connection.jsuploadFile has three weaknesses:
It buffers and base64-encodes the whole file before the 25 MB check, so a dropped ISO can crash the tab.
The timeout is a fixed total, so slow links (under ~0.5 Mbit/s) fail.
A disconnect SIGHUPs the server and leaves a partial file, because there's no cleanup trap.
Fix: check file.size first, stream with file.slice, use an idle timeout, and add a trap in cmd_upload that removes the partial file.
_Source: engineering review, 2026-10-07._
`web/src/connection.js` `uploadFile` has three weaknesses:
- It buffers and base64-encodes the whole file before the 25 MB check, so a dropped ISO can crash the tab.
- The timeout is a fixed total, so slow links (under ~0.5 Mbit/s) fail.
- A disconnect SIGHUPs the server and leaves a partial file, because there's no cleanup trap.
**Fix:** check `file.size` first, stream with `file.slice`, use an idle timeout, and add a `trap` in `cmd_upload` that removes the partial file.
jared
added this to the v0.5.0 hardening + header/phone milestone 2026-10-07 20:04:27 -04:00
jared
added the bug label 2026-10-07 20:04:27 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Source: engineering review, 2026-10-07.
web/src/connection.jsuploadFilehas three weaknesses:Fix: check
file.sizefirst, stream withfile.slice, use an idle timeout, and add atrapincmd_uploadthat removes the partial file.