DELETE /api/pastes/{id} deletes a paste even when no token and no credentials are supplied. Providing a wrong deletion_token in the JSON body also succeeds (returns {"status":"soft-deleted"}). The deletion token issued at create time is never validated.
Deleting with header Origin: https://evil.example also succeeds -> no CSRF protection either.
Impact: any visitor can permanently soft-delete any paste by ID; IDs are short (6 chars) and enumerated via /api/public. Cross-site deletion is possible (no SameSite=Strict, no CSRF token).
`DELETE /api/pastes/{id}` deletes a paste even when **no token and no credentials are supplied**. Providing a wrong `deletion_token` in the JSON body also succeeds (returns `{"status":"soft-deleted"}`). The deletion token issued at create time is never validated.
Repro (verified):
- `curl -X DELETE https://<host>/api/pastes/<id>` -> 200 `{"status":"soft-deleted"}`, paste gone (404 afterwards)
- `curl -X DELETE -d '{"deletion_token":"totally-wrong"}' https://<host>/api/pastes/<id>` -> 200, paste gone
- Deleting with header `Origin: https://evil.example` also succeeds -> no CSRF protection either.
Impact: any visitor can permanently soft-delete any paste by ID; IDs are short (6 chars) and enumerated via /api/public. Cross-site deletion is possible (no SameSite=Strict, no CSRF token).
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
DELETE /api/pastes/{id}deletes a paste even when no token and no credentials are supplied. Providing a wrongdeletion_tokenin the JSON body also succeeds (returns{"status":"soft-deleted"}). The deletion token issued at create time is never validated.Repro (verified):
curl -X DELETE https://<host>/api/pastes/<id>-> 200{"status":"soft-deleted"}, paste gone (404 afterwards)curl -X DELETE -d '{"deletion_token":"totally-wrong"}' https://<host>/api/pastes/<id>-> 200, paste goneOrigin: https://evil.examplealso succeeds -> no CSRF protection either.Impact: any visitor can permanently soft-delete any paste by ID; IDs are short (6 chars) and enumerated via /api/public. Cross-site deletion is possible (no SameSite=Strict, no CSRF token).