Security: clamp expires_in at API boundary (reject zero/negative, cap 1yr) #60

New Issue

2026-09-09T13:57:25Z

poslop commented

2026-09-09 13:57:25 +00:00

Split from #34 (LOW).

expires_in accepts negative/zero durations (already-expired pastes) and 87600h (10y) while UI caps at 1yr. Server-side clamp: min 1min, max 1yr.

Split from #34 (LOW). expires_in accepts negative/zero durations (already-expired pastes) and 87600h (10y) while UI caps at 1yr. Server-side clamp: min 1min, max 1yr.

poslop referenced this issue

2026-09-09 13:57:35 +00:00

Security pentest sweep #34

poslop referenced this issue from a commit

2026-09-09 14:13:56 +00:00

fix #60: clamp expires_in on cans API (400 on zero/negative, cap 1yr)

poslop referenced this issue from a commit

2026-09-09 14:15:40 +00:00

fix #60: apply ValidExpiry clamp to cans create handler (was lost in working tree)

poslop referenced a pull request that will close this issue

2026-09-09 14:15:55 +00:00

Clamp expires_in at API boundary (#60) #74

poslop referenced this issue from a commit

2026-09-09 14:21:26 +00:00

fix: input validation gaps (#68)

poslop referenced this issue

2026-09-09 14:21:37 +00:00

fix: input validation gaps (#68) #78

poslop closed this issue

2026-09-09 14:26:07 +00:00

poslop referenced this issue from a commit

2026-09-09 14:26:08 +00:00

Merge pull request 'Clamp expires_in at API boundary (#60)' (#74) from issue-60-expiry-clamp into main

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: poslop/palette#60