Rate-limit all password verification attempts (#81) #90

Merged

poslop merged 1 commits from fix-81-password-ratelimit into main

2026-09-09 15:59:24 +00:00

Author	SHA1	Message	Date
fen	99a044e8a2	Rate-limit all password verification attempts (#81 ) CI / docker (pull_request) Skipped Details CI / test (pull_request) Successful in 22s Details GET ?password= and X-Paste-Password header checks in handleGetPaste were unlimited (pentest2: 8 wrong = 8x401, no 429). Gate every password verification on the same per-IP+paste unlock limiter (5/min, 429 with Retry-After) already used by the POST unlock form path. Regression tests: repeated wrong passwords via GET ?password= and via header must eventually 429; correct password within burst still 200. Fixes #81	2026-09-09 10:58:21 -05:00

Author

SHA1

Message

Date

fen

99a044e8a2

Rate-limit all password verification attempts (#81 )

CI / docker (pull_request) Skipped

Details

CI / test (pull_request) Successful in 22s

Details

GET ?password= and X-Paste-Password header checks in handleGetPaste were
unlimited (pentest2: 8 wrong = 8x401, no 429). Gate every password
verification on the same per-IP+paste unlock limiter (5/min, 429 with
Retry-After) already used by the POST unlock form path.

Regression tests: repeated wrong passwords via GET ?password= and via
header must eventually 429; correct password within burst still 200.

Fixes #81

2026-09-09 10:58:21 -05:00