LOW findings from v0.5.0 pentest (record-only) #283

Open
opened 2026-09-18 01:25:33 +00:00 by fen · 1 comment
Collaborator

Owner decisions / small cleanups from the pre-release pentest, none blocking the release:

  1. Attachment pastes show size 0 in /api/public and history tables (pastes.size never set; view pages correct).
  2. Create response URLs use the random ID even when custom_slug was set (both resolve; cosmetic).
  3. Paste view pages have no
Owner decisions / small cleanups from the pre-release pentest, none blocking the release: 1. Attachment pastes show size 0 in /api/public and history tables (pastes.size never set; view pages correct). 2. Create response URLs use the random ID even when custom_slug was set (both resolve; cosmetic). 3. Paste view pages have no <title> element (title injection is properly escaped, no XSS). 4. /f/{aid}/{filename} ignores the filename component (no traversal; decorative-name disguise only). 5. go-enry returns None/type: text for clearly-Go pastes on dev build (observed during README screenshots; check whether prod detects correctly before treating as a bug).
fen added the Low label 2026-09-18 01:25:33 +00:00
Author
Collaborator

Prod check for item 5: created an identical small Go paste on p.archfox.org (p3jyh5) and palette-dev (hs86th). Both GET /api/pastes/{id} return language: null and the paste pages show no language badge. So the go-enry miss (None / type: text for clearly-Go content) reproduces on PROD too, not just the dev build. Record-only note; no fix dispatched per the issue's owner-decision scope.

Prod check for item 5: created an identical small Go paste on p.archfox.org (p3jyh5) and palette-dev (hs86th). Both GET /api/pastes/{id} return language: null and the paste pages show no language badge. So the go-enry miss (None / type: text for clearly-Go content) reproduces on PROD too, not just the dev build. Record-only note; no fix dispatched per the issue's owner-decision scope.
Sign in to join this conversation.