[pentest] Input validation gaps: negative/huge content accepted, expires_at ignored, limit=0 ignored #68

Closed
opened 2026-09-09 14:10:09 +00:00 by poslop · 0 comments
Owner

Blind test findings on paste creation:

  • A 5,000,000-char paste is accepted with 201 and no size limit error (storage exhaustion / DoS surface; no stated max).
  • expires_at: -1 and expires_in_seconds: -999999999 are accepted (201) and the resulting paste never expires - expiry fields silently ignored.
  • GET /api/public?limit=0 and limit=999999999 return full lists (limit not validated).
  • burn_after_reads: 0 behaves as 1 (ok) but is not rejected; negative -5 also accepted.
  • Arbitrary language strings (e.g. ../../etc/passwd) are stored/reflected (escaped, so not XSS, but unvalidated).
Blind test findings on paste creation: - A 5,000,000-char paste is accepted with 201 and no size limit error (storage exhaustion / DoS surface; no stated max). - `expires_at: -1` and `expires_in_seconds: -999999999` are accepted (201) and the resulting paste never expires - expiry fields silently ignored. - `GET /api/public?limit=0` and `limit=999999999` return full lists (limit not validated). - `burn_after_reads: 0` behaves as 1 (ok) but is not rejected; negative `-5` also accepted. - Arbitrary `language` strings (e.g. `../../etc/passwd`) are stored/reflected (escaped, so not XSS, but unvalidated).
Sign in to join this conversation.