merge: consolidate PRs #20, #21, #22, #23 with review fixes - #25
Merged
Conversation
- Add urlsplit import for safe host extraction - Log only upstream_host on login failure, not full response body - Expand test to verify no credentials/response leaked into logs
- Add quote import for safe URL encoding - Strip whitespace from category before use - URL-encode special characters in category stream IDs - Add max_length=200 to category query parameter - Parametrized test for category normalization (whitespace, /, %, ?, Unicode)
- Replace import_app() with main_module + test_client pytest fixtures - Add install_freshrss_transport() helper for stub transport - Rewrite endpoint tests to exercise the app through TestClient - Port secret-leak test (PR #20) and category normalization (PR #21) - Preserve reauthentication, timeout, and concurrent-safety tests
- Add FreshRSSOrigin, FreshRSSAlternate, FreshRSSItem, FreshRSSResponse models - Add validate_freshrss_response() with strict validation - Validate timestamps (finite, in-range) via field validator - Port validation tests to TestClient fixture style - Add pydantic>=2.0 dependency to pyproject.toml
After Pydantic validation (PR #23), a 403 retry that returns an empty dict is caught by validate_freshrss_response before the RequestException handler, producing 'invalid unread response' rather than 'unread request failed'.
PR #21 review (P2): Treat '.' and '..' categories as reading-list fallback - quote() leaves dots unchanged (RFC 3986 unreserved), so requests normalizes 'label/.' → 'label/' and 'label/..' → 'user/-/' as path traversal. Reject these labels before URL construction. PR #23 review (P2): Catch OverflowError from isfinite() on huge ints - math.isfinite() raises OverflowError when converting a huge Python int to float, before the existing try/except could wrap it as ValidationError. Now isfinite() is inside the guarded block, producing a 502 instead of a 500. Tests: dot-label parametrized cases + huge-int overflow test
This was referenced Jul 20, 2026
Skulldorom
marked this pull request as ready for review
July 20, 2026 10:01
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Merges four open PRs into a single branch with all conflicts resolved and review feedback applied.
PRs consolidated
Review feedback applied
./..) now fall back to reading-list (prevents path traversal via normalization)Merge resolution notes
Test results
44/44 passed — covering all four PRs' behaviors plus review-fix regressions.
Closes #20, closes #21, closes #22, closes #23.