[pentest2] public:false is ignored — pastes silently become fully public and listed in the public feed #83

Closed
opened 2026-09-09 15:40:30 +00:00 by poslop · 1 comment
Owner

Severity: Medium
Target: palette-dev v0.2.1

Sending "public": false at creation is silently ignored: the paste is stored with visibility: "public" and appears in /api/public (and is viewable by anyone).

Verified repro:

POST /api/pastes {"content":"PUBLIC-FALSE-LEAK-PROOF","public":false}   -> 201, id nr2zsd
GET /api/public?limit=200  -> id nr2zsd present
GET /api/pastes/nr2zsd     -> "visibility":"public"

Using the documented visibility: "unlisted" field works correctly, so API clients that use the intuitive boolean (public: false) leak content to the public listing. Either honor public:false (map to unlisted) or reject the unknown field with 400 so clients fail loudly instead of leaking.

**Severity:** Medium **Target:** palette-dev v0.2.1 Sending `"public": false` at creation is silently ignored: the paste is stored with `visibility: "public"` and appears in `/api/public` (and is viewable by anyone). Verified repro: ``` POST /api/pastes {"content":"PUBLIC-FALSE-LEAK-PROOF","public":false} -> 201, id nr2zsd GET /api/public?limit=200 -> id nr2zsd present GET /api/pastes/nr2zsd -> "visibility":"public" ``` Using the documented `visibility: "unlisted"` field works correctly, so API clients that use the intuitive boolean (`public: false`) leak content to the public listing. Either honor `public:false` (map to unlisted) or reject the unknown field with 400 so clients fail loudly instead of leaking.
Author
Owner

Fixed and merged to main (v0.2.2 pending release).

Fixed and merged to main (v0.2.2 pending release).
Sign in to join this conversation.