Only Strict-Transport-Security is sent on HTML pages. /raw/{id} correctly sends X-Content-Type-Options: nosniff, but all server-rendered pages (/, /new, /history, /mine, /settings, /admin, /{id}) lack:
Content-Security-Policy — no defense-in-depth if an escaping bug (or future regression) introduces XSS; currently onclick= inline handlers are used, so 'unsafe-inline' would at least be explicit
X-Frame-Options: DENY / frame-ancestors — paste pages (incl. password forms and burn confirm UIs) are frameable → clickjacking of the redeem/delete actions
X-Content-Type-Options: nosniff on HTML/JSON responses
Referrer-Policy — paste titles/IDs can leak via Referer to the external git.archfox.org link on every page
Cache-Control: no-store on paste content pages — shared caches may retain private paste content
**Severity:** Low
**Target:** palette-dev v0.2.1
Only `Strict-Transport-Security` is sent on HTML pages. `/raw/{id}` correctly sends `X-Content-Type-Options: nosniff`, but all server-rendered pages (`/`, `/new`, `/history`, `/mine`, `/settings`, `/admin`, `/{id}`) lack:
- `Content-Security-Policy` — no defense-in-depth if an escaping bug (or future regression) introduces XSS; currently `onclick=` inline handlers are used, so `'unsafe-inline'` would at least be explicit
- `X-Frame-Options: DENY` / `frame-ancestors` — paste pages (incl. password forms and burn confirm UIs) are frameable → clickjacking of the redeem/delete actions
- `X-Content-Type-Options: nosniff` on HTML/JSON responses
- `Referrer-Policy` — paste titles/IDs can leak via Referer to the external git.archfox.org link on every page
- `Cache-Control: no-store` on paste content pages — shared caches may retain private paste content
Root-caused: the middleware set headers AFTER the handler ran. Page handlers flush template output immediately, so header mutations after WriteHeader are silently discarded (the unit test passed because httptest.Recorder never flushes).
Fix: PR #87 sets the headers unconditionally before the handler. Live-verified on a local v0.2.1 build: CSP/Referrer-Policy/nosniff now present on /history, /{id}, /new.
Root-caused: the middleware set headers AFTER the handler ran. Page handlers flush template output immediately, so header mutations after WriteHeader are silently discarded (the unit test passed because httptest.Recorder never flushes).
Fix: PR #87 sets the headers unconditionally before the handler. Live-verified on a local v0.2.1 build: CSP/Referrer-Policy/nosniff now present on /history, /{id}, /new.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: Low
Target: palette-dev v0.2.1
Only
Strict-Transport-Securityis sent on HTML pages./raw/{id}correctly sendsX-Content-Type-Options: nosniff, but all server-rendered pages (/,/new,/history,/mine,/settings,/admin,/{id}) lack:Content-Security-Policy— no defense-in-depth if an escaping bug (or future regression) introduces XSS; currentlyonclick=inline handlers are used, so'unsafe-inline'would at least be explicitX-Frame-Options: DENY/frame-ancestors— paste pages (incl. password forms and burn confirm UIs) are frameable → clickjacking of the redeem/delete actionsX-Content-Type-Options: nosniffon HTML/JSON responsesReferrer-Policy— paste titles/IDs can leak via Referer to the external git.archfox.org link on every pageCache-Control: no-storeon paste content pages — shared caches may retain private paste contentRoot-caused: the middleware set headers AFTER the handler ran. Page handlers flush template output immediately, so header mutations after WriteHeader are silently discarded (the unit test passed because httptest.Recorder never flushes).
Fix: PR #87 sets the headers unconditionally before the handler. Live-verified on a local v0.2.1 build: CSP/Referrer-Policy/nosniff now present on /history, /{id}, /new.
Fixed and merged to main (v0.2.2 pending release).