A paste created with burn_after_read: true, burn_after_reads: 1 can be read more than once under concurrent requests - the burn counter decrement is not atomic (TOCTOU).
Repro: create 1-read burn paste, fire ~15-20 parallel GETs to /raw/{id}:
Run 1: 3x HTTP 200, 17x 404
Run 2: 2x HTTP 200, 13x 404
Expected: exactly one 200. Content meant to self-destruct after one read is delivered to multiple readers.
A paste created with `burn_after_read: true, burn_after_reads: 1` can be read more than once under concurrent requests - the burn counter decrement is not atomic (TOCTOU).
Repro: create 1-read burn paste, fire ~15-20 parallel GETs to /raw/{id}:
- Run 1: 3x HTTP 200, 17x 404
- Run 2: 2x HTTP 200, 13x 404
Expected: exactly one 200. Content meant to self-destruct after one read is delivered to multiple readers.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
A paste created with
burn_after_read: true, burn_after_reads: 1can be read more than once under concurrent requests - the burn counter decrement is not atomic (TOCTOU).Repro: create 1-read burn paste, fire ~15-20 parallel GETs to /raw/{id}:
Expected: exactly one 200. Content meant to self-destruct after one read is delivered to multiple readers.