handleDeletePaste accepts the deletion token via ?token= and the paste view JS fetches /api/pastes/{id}/redeem?token=. URL-carried bearer tokens end up in Traefik access logs and browser history; anyone with log access can delete/redeem the paste. Lower impact than an admin key since scope is one paste, but the same class of issue.
Repro
1. Create paste, note deletion_token T and id I.
2. curl -sk -X DELETE "https://palette-dev.archfox.org/api/pastes/$I?token=$T" -> 200 soft-deleted; token now sits in access logs
Expected: header-based token only, or a short-lived one-time URL token.
Actual: long-lived bearer secret accepted in URL.
Found during exploratory security/bug pass on palette-dev (2026-09-09). Reporting only, no fix attached.
handleDeletePaste accepts the deletion token via ?token= and the paste view JS fetches /api/pastes/{id}/redeem?token=. URL-carried bearer tokens end up in Traefik access logs and browser history; anyone with log access can delete/redeem the paste. Lower impact than an admin key since scope is one paste, but the same class of issue.
### Repro
```
1. Create paste, note deletion_token T and id I.
2. curl -sk -X DELETE "https://palette-dev.archfox.org/api/pastes/$I?token=$T" -> 200 soft-deleted; token now sits in access logs
Expected: header-based token only, or a short-lived one-time URL token.
Actual: long-lived bearer secret accepted in URL.
```
Found during exploratory security/bug pass on palette-dev (2026-09-09). Reporting only, no fix attached.
fen
added spent time 5 seconds2026-09-10 03:49:08 +00:00
fen
added the Low label 2026-09-10 03:49:49 +00:00
Fix proposal: accept the deletion token only in the X-Deletion-Token header (and in the POST body of the UI flow), remove the ?token= query path, and redirect-strip tokens from URLs. One-file change in the deletion handler plus template updates.
Fix proposal: accept the deletion token only in the X-Deletion-Token header (and in the POST body of the UI flow), remove the ?token= query path, and redirect-strip tokens from URLs. One-file change in the deletion handler plus template updates.
fen
added spent time 5 seconds2026-09-10 13:18:19 +00:00
fen
added the In Progress label 2026-09-10 13:18:20 +00:00
Authorization: Bearer header delete -> 200 soft-delete, redeem -> 200 hard delete, both confirmed live.
Rendered paste view (creator cookie) shows the danger delete button wired to sessionStorage deletion_token_ + header-based redeem.
Note: QA found the PR initially never SET the tok_ cookie (read-only in web.go), which would have broken the one-time created-banner token display; fixed on the branch (commit 00aaafe) with tests before merge.
Closing, branch deleted.
QA passed on live palette-dev (image @sha256:813958aa..., merge commit fe75dfc on dev).
- Create flow sets short-lived HttpOnly tok_<id> cookie (60s); no deletion token appears in any URL (created banner flow verified via cookie; grep token= in rendered page = 0).
- DELETE /api/pastes/{id}?token=<correct token> -> 403, paste survives; DELETE /api/pastes/{id}/redeem?token= -> 400, paste survives.
- Authorization: Bearer header delete -> 200 soft-delete, redeem -> 200 hard delete, both confirmed live.
- Rendered paste view (creator cookie) shows the danger delete button wired to sessionStorage deletion_token_<id> + header-based redeem.
Note: QA found the PR initially never SET the tok_<id> cookie (read-only in web.go), which would have broken the one-time created-banner token display; fixed on the branch (commit 00aaafe) with tests before merge.
Closing, branch deleted.
fen
added spent time 40 seconds2026-09-10 13:41:35 +00:00
fen
added spent time 1 hour 23 minutes2026-09-10 13:54:10 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
handleDeletePaste accepts the deletion token via ?token= and the paste view JS fetches /api/pastes/{id}/redeem?token=. URL-carried bearer tokens end up in Traefik access logs and browser history; anyone with log access can delete/redeem the paste. Lower impact than an admin key since scope is one paste, but the same class of issue.
Repro
Found during exploratory security/bug pass on palette-dev (2026-09-09). Reporting only, no fix attached.
Fix proposal: accept the deletion token only in the X-Deletion-Token header (and in the POST body of the UI flow), remove the ?token= query path, and redirect-strip tokens from URLs. One-file change in the deletion handler plus template updates.
QA passed on live palette-dev (image @sha256:813958aa..., merge commit
fe75dfcon dev).Note: QA found the PR initially never SET the tok_ cookie (read-only in web.go), which would have broken the one-time created-banner token display; fixed on the branch (commit
00aaafe) with tests before merge.Closing, branch deleted.