fix: harden AnkiConnect resolver and stats-server route validation

- Warn and fall back for invalid primitive values across modern/legacy AnkiConnect config subtrees
- Validate AniList ID as positive integer; add timeout to AniList search fetch
- Reject non-safe or fractional session IDs; return 404 for malformed percent-encoded asset paths
- Guard word-mode mining: require non-empty word and Yomitan bridge before starting media work
- Include note ID in mined media filenames to prevent collisions
- Silence throwing timing observers so they cannot abort mining execution
- Trim whitespace from excludePos query param entries
This commit is contained in:
2026-07-16 00:07:18 -07:00
parent 83fffe533a
commit 1ee9415eda
14 changed files with 646 additions and 81 deletions
+5
View File
@@ -0,0 +1,5 @@
type: fixed
area: stats
- Validated nested and legacy AnkiConnect settings after splitting the resolver, preserving valid modern overrides while warning and falling back for invalid primitive values.
- Hardened stats routes against malformed IDs and static paths, stalled AniList searches, word-mining media collisions, missing Yomitan bridges, and throwing timing observers.