title and language are stored without length/format validation: a 5000-character title and a language of "<img src=x onerror=alert(1)>" are both accepted and echoed back in /api/public and paste pages. Output escaping is correct everywhere I checked (server-side <...>, client-side esc() in table.js), so this is data pollution / listing bloat, not XSS — but an attacker can make the public listing heavier (titles of arbitrary length appear in every feed response). Recommend validating language against the supported set and capping title length server-side (client cap only via the input).
**Severity:** Info/Low
**Target:** palette-dev v0.2.1
`title` and `language` are stored without length/format validation: a 5000-character title and a `language` of `"<img src=x onerror=alert(1)>"` are both accepted and echoed back in `/api/public` and paste pages. Output escaping is correct everywhere I checked (server-side `<...>`, client-side `esc()` in table.js), so this is data pollution / listing bloat, not XSS — but an attacker can make the public listing heavier (titles of arbitrary length appear in every feed response). Recommend validating `language` against the supported set and capping title length server-side (client cap only via the input).
Fixed in PR #91: title truncated to 200 chars, language validated against ^[a-zA-Z0-9+#-]{1,40}$ with a clear 400 otherwise. Regression tests included.
Fixed in PR #91: title truncated to 200 chars, language validated against ^[a-zA-Z0-9+#-]{1,40}$ with a clear 400 otherwise. Regression tests included.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: Info/Low
Target: palette-dev v0.2.1
titleandlanguageare stored without length/format validation: a 5000-character title and alanguageof"<img src=x onerror=alert(1)>"are both accepted and echoed back in/api/publicand paste pages. Output escaping is correct everywhere I checked (server-side<...>, client-sideesc()in table.js), so this is data pollution / listing bloat, not XSS — but an attacker can make the public listing heavier (titles of arbitrary length appear in every feed response). Recommend validatinglanguageagainst the supported set and capping title length server-side (client cap only via the input).Fixed in PR #91: title truncated to 200 chars, language validated against ^[a-zA-Z0-9+#-]{1,40}$ with a clear 400 otherwise. Regression tests included.
Fixed and merged to main (v0.2.2 pending release).