poslop/palette
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases 2 Wiki Activity
108 Commits 3 Branches 8 Tags
15f199b2fe97578668f139bd542e8e299d16bb77
Commit Graph
3 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
fen 389e4d333f Bound title and language at create time (#86)
CI / test (pull_request) Successful in 21s
Details
CI / docker (pull_request) Skipped
Details 
Titles are trimmed and truncated to 200 characters; language must be
blank or match ^[a-zA-Z0-9+#-]{1,40}$ (max 40 chars) or the create is
rejected with a clear 400. Regression tests cover truncation, malformed
and oversized language values, valid identifiers, and blank metadata.
 2026-09-09 10:58:34 -05:00
fen 99a044e8a2 Rate-limit all password verification attempts (#81)
CI / test (pull_request) Successful in 22s
Details
CI / docker (pull_request) Skipped
Details 
GET ?password= and X-Paste-Password header checks in handleGetPaste were
unlimited (pentest2: 8 wrong = 8x401, no 429). Gate every password
verification on the same per-IP+paste unlock limiter (5/min, 429 with
Retry-After) already used by the POST unlock form path.

Regression tests: repeated wrong passwords via GET ?password= and via
header must eventually 429; correct password within burst still 200.

Fixes #81
 2026-09-09 10:58:21 -05:00
fen bb5c4f0186 fix #60: apply ValidExpiry clamp to cans create handler (was lost in working tree)
CI / test (pull_request) Successful in 27s
Details
CI / docker (pull_request) Skipped
Details
2026-09-09 09:15:39 -05:00