fix: address verified findings from Cora scan

[ajianaz]

What

Fixes the verified items from a cora scan triage: CLI temp input files, empty-slides panic, DNS timeout, local image read cap, escaped input in b64/wordwrap filters, and several small correctness/hardening fixes.

Why

Cora flagged 37 items; after triage the real ones were: fixed /tmp/cosy-*-input.json names (clobbering, symlink risk, never cleaned), slides[0] panics under panic=abort, unbounded DNS/local reads, and filters receiving XML-escaped text (& in URLs, entities split by wrapping). Closes #136. False positives (empty COSY_SIGNING_KEY, default bind, CORS, CLI template paths) were deliberately left alone.

How

• TempInput guard: unique name, create_new, 0600, removed on drop.
• slide_at() + early bail for empty slides; --dump-svg guarded too.
• resolve_with_timeout (helper thread + recv_timeout); File::take cap for local images.
• unescape_xml_entities used by wordwrap/b64; is_xml_char range check for numeric refs.
• Server: 500 on listing failure, envelope dims = out_w/out_h, case-insensitive Bearer.
• Small: --scale value parser, CSV BOM, HTTP://, NAT64/doc IPv6, comment fixes.

Testing

• cargo test passes (new tests for each fix)
• cargo fmt --all -- --check passes
• cargo clippy --all-targets -- -D warnings passes
• cargo build --release passes (CI)
• Manual smoke-test: concurrent inline-JSON CLI runs, TMPDIR left empty, empty slides exits with a message

Related Issues

Closes #136

Checklist

• Branch name follows convention
• Branch is from develop

🤖 Generated with Claude Code

[github-actions]

🔍 Cora AI Code Review

✅ No issues found. Code looks good!

---

Review powered by cora-code · BYOK · MIT