fen 99a044e8a2 Rate-limit all password verification attempts (#81) ...

GET ?password= and X-Paste-Password header checks in handleGetPaste were
unlimited (pentest2: 8 wrong = 8x401, no 429). Gate every password
verification on the same per-IP+paste unlock limiter (5/min, 429 with
Retry-After) already used by the POST unlock form path.

Regression tests: repeated wrong passwords via GET ?password= and via
header must eventually 429; correct password within burst still 200.

Fixes #81

2026-09-09 10:58:21 -05:00

..

admin_test.go

Refactor: split monolith into cmd/palette + internal/{store,api,web,lang} (#35)

2026-09-09 01:33:39 -05:00

admin.go

admin: per-IP rate limit (5/min) on admin key attempts (#66)

2026-09-09 09:15:01 -05:00

adminratelimit_test.go

admin: per-IP rate limit (5/min) on admin key attempts (#66)

2026-09-09 09:15:01 -05:00

burn_test.go

Refactor: split monolith into cmd/palette + internal/{store,api,web,lang} (#35)

2026-09-09 01:33:39 -05:00

burn.go

Refactor: split monolith into cmd/palette + internal/{store,api,web,lang} (#35)

2026-09-09 01:33:39 -05:00

burnrace_test.go

fix: atomic burn-after-read claim (#58)

2026-09-09 09:18:42 -05:00

burnreads_test.go

Refactor: split monolith into cmd/palette + internal/{store,api,web,lang} (#35)

2026-09-09 01:33:39 -05:00

cans_expiry_test.go

fix #60: clamp expires_in on cans API (400 on zero/negative, cap 1yr)

2026-09-09 09:13:21 -05:00

cans_test.go

Refactor: split monolith into cmd/palette + internal/{store,api,web,lang} (#35)

2026-09-09 01:33:39 -05:00

cans.go

fix #60: apply ValidExpiry clamp to cans create handler (was lost in working tree)

2026-09-09 09:15:39 -05:00

customslug_test.go

Refactor: split monolith into cmd/palette + internal/{store,api,web,lang} (#35)

2026-09-09 01:33:39 -05:00

delete_auth_test.go

fix #63: require deletion token on DELETE /api/pastes/{id}

2026-09-09 09:21:28 -05:00

guess.go

Refactor: split monolith into cmd/palette + internal/{store,api,web,lang} (#35)

2026-09-09 01:33:39 -05:00

issue68_validation_test.go

fix: input validation gaps (#68)

2026-09-09 09:21:25 -05:00

issue81_password_ratelimit_test.go

Rate-limit all password verification attempts (#81)

2026-09-09 10:58:21 -05:00

main_test.go

Merge pull request 'docs: design for optional client-side E2E encryption (issue #39)' (#75) from issue-39-e2e-design into main

2026-09-09 14:26:02 +00:00

mine_test.go

Refactor: split monolith into cmd/palette + internal/{store,api,web,lang} (#35)

2026-09-09 01:33:39 -05:00

pentest_cookie_test.go

Refactor: split monolith into cmd/palette + internal/{store,api,web,lang} (#35)

2026-09-09 01:33:39 -05:00

pentest_helpers_test.go

Refactor: split monolith into cmd/palette + internal/{store,api,web,lang} (#35)

2026-09-09 01:33:39 -05:00

pentest_rawct_test.go

Refactor: split monolith into cmd/palette + internal/{store,api,web,lang} (#35)

2026-09-09 01:33:39 -05:00

ratelimit_test.go

Refactor: split monolith into cmd/palette + internal/{store,api,web,lang} (#35)

2026-09-09 01:33:39 -05:00

ratelimit.go

admin: per-IP rate limit (5/min) on admin key attempts (#66)

2026-09-09 09:15:01 -05:00

server.go

Rate-limit all password verification attempts (#81)

2026-09-09 10:58:21 -05:00

slugrelease_test.go

Refactor: split monolith into cmd/palette + internal/{store,api,web,lang} (#35)

2026-09-09 01:33:39 -05:00

sweep33_test.go

Refactor: split monolith into cmd/palette + internal/{store,api,web,lang} (#35)

2026-09-09 01:33:39 -05:00

validate.go

fix: input validation gaps (#68)

2026-09-09 09:21:25 -05:00