@striae-org/striae 4.1.0 → 4.2.1

package/workers/data-worker/wrangler.jsonc.example

@@ -3,7 +3,7 @@
   "name": "DATA_WORKER_NAME",
   "account_id": "ACCOUNT_ID",
   "main": "src/data-worker.ts",
-  "compatibility_date": "2026-03-19",
+  "compatibility_date": "2026-03-21",
   "compatibility_flags": [
     "nodejs_compat"
   ], 

package/workers/image-worker/package.json

@@ -12,7 +12,7 @@
 		"@cloudflare/puppeteer": "^1.0.6",
 		"@cloudflare/vitest-pool-workers": "^0.13.0",
 		"vitest": "~4.1.0",
-		"wrangler": "^4.73.0"
+		"wrangler": "^4.76.0"
 	},
 	"overrides": {
 		"undici": "7.24.1",

package/workers/image-worker/src/image-worker.example.ts

@@ -145,17 +145,28 @@ async function handleImageServing(request: Request, env: Env): Promise<Response>
 
   const url = new URL(request.url);
   const encodedPath = url.pathname.slice(1);
-  let decodedPath = encodedPath;
+  if (!encodedPath) {
+    return createResponse({ error: 'Image delivery URL is required' }, 400);
+  }
+
+  let decodedPath: string;
 
   try {
     decodedPath = decodeURIComponent(encodedPath);
   } catch {
-    decodedPath = encodedPath;
+    return createResponse({ error: 'Image delivery URL must be URL-encoded' }, 400);
   }
 
-  const imageDeliveryURL = new URL(
-    decodedPath.replace('https:/imagedelivery.net', 'https://imagedelivery.net')
-  );
+  let imageDeliveryURL: URL;
+  try {
+    imageDeliveryURL = new URL(decodedPath);
+  } catch {
+    return createResponse({ error: 'Image delivery URL is invalid' }, 400);
+  }
+
+  if (imageDeliveryURL.protocol !== 'https:' || imageDeliveryURL.hostname !== 'imagedelivery.net') {
+    return createResponse({ error: 'Image delivery URL must target imagedelivery.net over HTTPS' }, 400);
+  }
   
   return generateSignedUrl(imageDeliveryURL, env);
 }