# Harden attachment ID resolution and missing-file handling · pingdotgg/t3code

[View on GitCafe](https://git.cafe/pingdotgg/t3code/commit/88dc6c94aa392e294b962cc071ea837931af3792)

Repository: [pingdotgg/t3code](https://git.cafe/pingdotgg/t3code)

Visibility: public

Requested revision: 88dc6c94aa392e294b962cc071ea837931af3792

Requested commit: 88dc6c94aa392e294b962cc071ea837931af3792

Commit: 88dc6c94aa392e294b962cc071ea837931af3792

Tree: 4df87519513721ff34b81b39a04b2ea3ae5606c5

Author: Julius Marminge

Committer: Julius Marminge

## Message

```
Harden attachment ID resolution and missing-file handling

- Sanitize thread-derived attachment ID segments to safe, bounded tokens
- Resolve attachment IDs only when a matching file exists on disk
- Return 404 (not 400) for missing attachment IDs in the attachment route
- Add attachmentStore tests for ID sanitization and extension-based path lookup

```

## Parents

- [585031572f8e2e909b6da3b84677dc304b4cb4b9](https://git.cafe/pingdotgg/t3code/commit/585031572f8e2e909b6da3b84677dc304b4cb4b9?format=markdown)

[Source at this commit](https://git.cafe/pingdotgg/t3code/tree/88dc6c94aa392e294b962cc071ea837931af3792?format=markdown)