The create/paste rate limit appears keyed on X-Forwarded-For when provided: rotating a fake XFF per request allowed 5 consecutive creates (burst) per fake address, vs a shared bucket otherwise.
Verified:
8 rapid creates with X-Forwarded-For: 1.2.3.<i> -> 5x 201, then 429s
7 rapid creates with fixed XFF 9.9.9.9 -> 5x 201, then 429
An attacker can multiply their effective rate by the number of spoofed addresses (for bulk paste spam / storage exhaustion; 2 MB pastes are accepted — cap is above 5 MB, 20 MB returns 413). If the proxy is expected to sanitize XFF, ensure the app trusts only the proxy-set rightmost hop; password attempts and admin key attempts appear keyed per-paste/per-endpoint and were not bypassable this way.
**Severity:** Low/Medium (deployment-dependent)
**Target:** palette-dev v0.2.1 behind proxy
The create/paste rate limit appears keyed on `X-Forwarded-For` when provided: rotating a fake XFF per request allowed 5 consecutive creates (burst) per fake address, vs a shared bucket otherwise.
Verified:
```
8 rapid creates with X-Forwarded-For: 1.2.3.<i> -> 5x 201, then 429s
7 rapid creates with fixed XFF 9.9.9.9 -> 5x 201, then 429
```
An attacker can multiply their effective rate by the number of spoofed addresses (for bulk paste spam / storage exhaustion; 2 MB pastes are accepted — cap is above 5 MB, 20 MB returns 413). If the proxy is expected to sanitize XFF, ensure the app trusts only the proxy-set rightmost hop; password attempts and admin key attempts appear keyed per-paste/per-endpoint and were not bypassable this way.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: Low/Medium (deployment-dependent)
Target: palette-dev v0.2.1 behind proxy
The create/paste rate limit appears keyed on
X-Forwarded-Forwhen provided: rotating a fake XFF per request allowed 5 consecutive creates (burst) per fake address, vs a shared bucket otherwise.Verified:
An attacker can multiply their effective rate by the number of spoofed addresses (for bulk paste spam / storage exhaustion; 2 MB pastes are accepted — cap is above 5 MB, 20 MB returns 413). If the proxy is expected to sanitize XFF, ensure the app trusts only the proxy-set rightmost hop; password attempts and admin key attempts appear keyed per-paste/per-endpoint and were not bypassable this way.
Fixed and merged to main (v0.2.2 pending release).