fix(play): serve the album (decode URLs, support byte ranges) - #74
Merged
Merged
Conversation
The production game file server (start-all.mjs) looked the raw URL up on disk without percent-decoding it. Every track on Þrøngva's album is requested as .../%C3%9Er%C3%B8ngva/After%20the%20Winter%20of%20Want/..., found nothing, and got index.html with a 200 from the SPA fallback, so no music played on nightcell7.com. The old "More Than Enough.mp3" had the same problem. - Decode the path (400 on malformed encoding) before resolving it; the traversal guard now checks against dist + separator, so a decoded %2e%2e%2f or a sibling like dist-old cannot escape. - Support single byte ranges (206/416) and stream files: Safari will not play <audio> from a server that ignores Range, and a whole-file read buffered every 9 MB track in memory per request. - The server moves to game-static.mjs so it has tests. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
ThreatCrush Security Scan9 finding(s) HIGH/CRITICAL: 4 | MEDIUM: 5
Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Live bug: none of the album tracks play on nightcell7.com. Each MP3 request returns
index.htmlwith a 200.Cause: the built-in game file server in
start-all.mjsnever percent-decoded the URL.…/%C3%9Er%C3%B8ngva/After%20the%20Winter%20of%20Want/…was looked up on disk literally, so any file whose name has a space or a non-ASCII letter could never be served. That includes the oldMore Than Enough.mp3.Fix:
dist-old, which the old prefix check let through.<audio>from a server that ignores Range.tools/release/game-static.mjswith 8 tests.Checked locally against the real production build: album track 019 returns 200 as
audio/mpegwith all 3,164,787 bytes, andRange: bytes=0-1023returns 206.🤖 Generated with Claude Code