handleGetPaste accepts the password via ?password= (and X-Paste-Password header). Query strings are captured by Traefik access logs and browser history. The unlock limiter (#81) prevents brute force, but the secret itself is exposed to anyone with log access. Consider dropping the query-param path or documenting it as unsafe.
Repro
1. Create unlisted+password paste.
2. curl -sk --resolve palette-dev.archfox.org:443:10.0.1.47 "https://palette-dev.archfox.org/api/pastes/$ID?password=pw" -> 200 with content
Expected: password only via POST /unlock body or X-Paste-Password header.
Actual: 200 via URL query.
Found during exploratory security/bug pass on palette-dev (2026-09-09). Reporting only, no fix attached.
handleGetPaste accepts the password via ?password= (and X-Paste-Password header). Query strings are captured by Traefik access logs and browser history. The unlock limiter (#81) prevents brute force, but the secret itself is exposed to anyone with log access. Consider dropping the query-param path or documenting it as unsafe.
### Repro
```
1. Create unlisted+password paste.
2. curl -sk --resolve palette-dev.archfox.org:443:10.0.1.47 "https://palette-dev.archfox.org/api/pastes/$ID?password=pw" -> 200 with content
Expected: password only via POST /unlock body or X-Paste-Password header.
Actual: 200 via URL query.
```
Found during exploratory security/bug pass on palette-dev (2026-09-09). Reporting only, no fix attached.
fen
added spent time 5 seconds2026-09-10 03:49:08 +00:00
fen
added the Medium label 2026-09-10 03:49:49 +00:00
Fixed in PR #150: ?password= is no longer accepted on paste/can reads (repro now returns 401); the X-Paste-Password header and POST unlock form still work, re-verified 200. Log: 30m.
Fixed in PR #150: ?password= is no longer accepted on paste/can reads (repro now returns 401); the X-Paste-Password header and POST unlock form still work, re-verified 200. Log: 30m.
fen
added QA and removed In Progress labels 2026-09-10 04:23:28 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
handleGetPaste accepts the password via ?password= (and X-Paste-Password header). Query strings are captured by Traefik access logs and browser history. The unlock limiter (#81) prevents brute force, but the secret itself is exposed to anyone with log access. Consider dropping the query-param path or documenting it as unsafe.
Repro
Found during exploratory security/bug pass on palette-dev (2026-09-09). Reporting only, no fix attached.
Fixed in PR #150: ?password= is no longer accepted on paste/can reads (repro now returns 401); the X-Paste-Password header and POST unlock form still work, re-verified 200. Log: 30m.