Security: fix burn-after-read race (atomic conditional delete) #58

New Issue

2026-09-09T13:57:25Z

poslop commented

2026-09-09 13:57:25 +00:00

Split from #34 (MED).

Concurrent reads of a burn_after_read paste can all succeed before SoftDelete lands. Verified in #34: 4/6 concurrent API readers received content. Check-then-delete in registerRead is not atomic.

Fix: atomic conditional UPDATE (deleted_at WHERE id=? AND deleted_at IS NULL) checked via RowsAffected before returning content, or a reads_used conditional guard for burn-after-N.

Split from #34 (MED). Concurrent reads of a burn_after_read paste can all succeed before SoftDelete lands. Verified in #34: 4/6 concurrent API readers received content. Check-then-delete in registerRead is not atomic. Fix: atomic conditional UPDATE (deleted_at WHERE id=? AND deleted_at IS NULL) checked via RowsAffected before returning content, or a reads_used conditional guard for burn-after-N.

poslop referenced this issue

2026-09-09 13:57:35 +00:00

Security pentest sweep #34

poslop referenced this issue

2026-09-09 14:11:22 +00:00

[pentest] Burn-after-read counter race: single-read paste can be fetched multiple times concurrently #62

poslop referenced this issue from a commit

2026-09-09 14:13:09 +00:00

fix: atomic burn-after-read claim (#58)

poslop referenced this issue from a commit

2026-09-09 14:18:58 +00:00

fix: atomic burn-after-read claim (#58)