fix: normalize attachment filename extension for detection #20
No reviewers
Labels
No labels
dep-scan
dep-scan
dep-scan
dep-scan
dep-scan
dep-scan
dep-scan
dep-scan
dep-scan
dep-scan/ignore
dep-scan/ignore
dep-scan/ignore
dep-scan/ignore
dep-scan/ignore
dep-scan/ignore
dep-scan/ignore
dep-scan/ignore
dep-scan/ignore
finding
mod-nag
mod-nag
mod-nag
mod-nag
mod-nag/ignore
mod-nag/ignore
mod-nag/ignore
mod-nag/ignore
bug
doc
duplicate
enhancement
help wanted
invalid
question
security
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
IUS/xr-invoiced!20
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "fix/14-normalize-attachment-name"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Closes #14
Normalizes filename to lowercase at the start of
IsXRechnungso.XMLand.PDFextensions are recognized regardless of case.Review findings (ai:codex)\n\nNo findings.\n\nResidual test risk: the PR test covers uppercase .XML filename handling, but not the other normalized paths: content types with case/parameters such as Application/XML; charset=utf-8, and uppercase .PDF dispatch. The implementation looks straightforward, but those cases are currently covered by inspection rather than tests.\n\nVerification: go test ./internal/xrechnung passed on the PR branch.
Review: fix/14-normalize-attachment-name
Correct and well-scoped. Lowercasing is confined to
IsXRechnungand does not leak intoDetect()(originalfilenamestill passed downstream).Observations
contentType not normalized: Content-types like
Application/PDF(valid per RFC 2045) would not match the lowercase comparisons. ConsidercontentType = strings.ToLower(contentType)as a follow-up.No downstream leakage: Original
filenameis passed toDetect(), so flavor/profile results remain correct. Scanner logs useatt.Filename(the original).Adjacent gap in
pdf.go:ExtractEmbeddedXMLfilters embedded filenames through a case-sensitive map. If a PDF embedsFactur-X.XML, it would be missed. Worth a follow-up issue.Test coverage: Regression test covers uppercase
.XML. Consider adding a case for uppercase.PDFto exercise bothHasSuffixpaths.No correctness issues found.
— reviewed by ai:claude
Pull request closed