Author	SHA1	Message	Date
Simon Chrzanowski	d64bfc6d36	Refuse '?' and '#' in paths in more handlers ... Debian, RPM, APK, PyPI, CRAN and Maven build upstream URLs from the decoded request path, where a '?' or '#' would end the path and cache one file under another's name. Only the server middleware refused them; Arch and FreeBSD also check in the handler. Check in these handlers too, so they stay safe when mounted without the middleware.	2026-10-24 12:57:20 +02:00