Merge pull request 'Secrets via headers only: drop ?key= and ?password= query fallbacks (#137, #141)' (#150) from fix-137-141-drop-query-secrets into dev

2026-09-10 04:23:27 +00:00
parent 22c66243d5 d013f3965f
commit d44e4d1587
8 changed files with 29 additions and 29 deletions
@@ -273,18 +273,17 @@ func (a *apiServer) handleGetPaste(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	if row.PasswordHash.Valid {
-		// #81: every password verification (header, query param, or empty)
-		// goes through the same per-IP+paste unlock limiter as the POST form
-		// path, so brute-force via GET ?password= or X-Paste-Password gets 429.
+		// #81/#141: every password verification (header or empty) goes
+		// through the same per-IP+paste unlock limiter as the POST form
+		// path, so brute-force via X-Paste-Password gets 429. The
+		// ?password= query fallback was removed (#141): query strings
+		// leak into access logs, browser history, and Referer headers.
 		if !rateLimitUnlock(row.ID, r) {
 			writeRateLimited(w, 60)
 			return
 		}
 		// require password via header or query
 		pw := r.Header.Get("X-Paste-Password")
-		if pw == "" {
-			pw = r.URL.Query().Get("password")
-		}
 		if pw == "" || !store.CheckPassword(row.PasswordHash.String, pw) {
 			writeErr(w, 401, "password required")
 			return