Files
hermes-webui/tests
happy5318 72cab65817 fix: pread snapshot + size cap + TOCTOU — address round-2 review (3 issues)
1. _ETAG_SIZE_CAP (10MB): files above skip ETag to avoid hashing large
   media / Range requests.

2. _etag_and_snapshot: single pread into immutable bytes; the ETag
   describes the exact snapshot that is sent, eliminating TOCTOU.

3. ETag computation moved inside fd-lifecycle try/finally; pread
   failures raise OSError caught by the outer except -> 500 + fd closed.

4. no-store content (HTML previews) skips ETag unconditionally.

5. Tests: large-file cap, pread-failure 500+fd-closed, TOCTOU snapshot
   correctness.

Related tests: 20/20 targeted + 33 neighboring passed.
2026-08-11 18:12:04 +08:00
..