[iFixRobots]

Some inbound LINE images never show up in Beeper. The message carries a DOWNLOAD_URL that's a full URL, but DownloadOBSPublicResource only accepts a path on the OBS host. The download fails and the whole message is skipped:

warn  Failed to download image from OBS  error="public OBS resource must be an absolute path" oid="" public_resource=true
debug Remote message handling was cancelled by convert function  error="ignoring remote event: failed to download image from LINE OBS: public OBS resource must be an absolute path"

One cloud account hit this for 71 images in a day. LINE Chrome accepts both forms: if new URL(DOWNLOAD_URL) parses, it fetches it as-is; otherwise it prefixes the OBS base. Either way it sends no LINE auth headers.

The bridge now does the same. Because the URL comes from message metadata, full URLs go through the public-only transport the Viber and WeChat bridges use for sender-supplied URLs: http/https only, every resolved address must be public and gets pinned, and at most 3 redirects, each one re-checked. Those downloads are also capped at Beeper's 100 MB file limit and 45 s, the same timeout Viber uses for media. Relative paths work as before.

	Before	After
DOWNLOAD_URL is a full URL	message dropped	image bridged
DOWNLOAD_URL is a /r/... path	OBS download	unchanged
Full URL over 100 MB	message dropped	100 MB notice, like other oversized media
URL resolving to a private or loopback address	rejected	rejected

Before / after (local, macOS)

Before: main (9be42f2). After: 625183f (this branch, already up to date with main). Each build ran a throwaway, uncommitted Go test in pkg/line that calls DownloadOBSPublicResource directly. No LINE account was involved, so this covers the download, not a full inbound message.

DOWNLOAD_URL	Before	After
Full URL to a public PNG	public OBS resource must be an absolute path	1,208 bytes downloaded
http://169.254.169.254/...	same path error	unsupported LINE public media URL
http://127.0.0.1:<port>/image (local server)	same path error	unsupported LINE public media URL
Public URL that redirects to http://127.0.0.1/	same path error	rejected at the redirect
/r/... path	OBS request, LINE OBS object not found	unchanged

Tag @indent to continue the conversation here.

[indent]

Issues

All clear! No issues remaining. 🎉

2 issues already resolved

• Full-URL image downloads from sender-controlled DOWNLOAD_URL are read with an unbounded io.ReadAll and no client timeout. A public host can stream an endless body to exhaust bridge memory, or stall indefinitely and block message handling. Add a size cap and a timeout. (fixed by commit 3418254)
  _{Found by Indent Review Agent}
• For a non-200 response from a sender-controlled host, up to 100 MiB of the response body is put into the error string and then logged. Truncate the body to a few hundred bytes before formatting the error. (fixed by commit 1bb0098)
  _{Found by Indent Review Agent}

CI Checks

All CI checks passed on ef42052.

Review agents

Select any unchecked box below to run or rerun that agent.

Passed (1)

• Indent Review Agent · No remaining issues found

Full results

Indent Review Agent

• Summary: No remaining issues found
• Last ran on commit: ef42052a
• Latest result

  {
    "summary": "No remaining issues found",
    "findings": []
  }

[highesttt]

Looks good; just one thing

• Oversized images are dropped without the 100MB notice, then would be backfilled upon restart. there should probably be better error handling here