fen f63efc6d88 Fix rate limiter bypass via client-controlled X-Forwarded-For (#280) ...

clientIP() keyed rate-limit buckets on the rightmost X-Forwarded-For
entry, assuming traefik appends the real client IP. The deployed ingress
does not rewrite XFF, so rotating the header gave a fresh bucket per
request (pentest H1: 8 creates with rotating XFF -> 6x201).

Now the bucket keys on the actual peer address (RemoteAddr) by default;
every client-supplied IP header is ignored. Deployments whose ingress
overwrites a client-IP header can opt in via PALETTE_TRUSTED_IP_HEADER
(e.g. CF-Connecting-IP behind Cloudflare) to restore per-client limits.

Adds tests: rotating XFF no longer resets the bucket; the trusted header
is honored only when explicitly configured.

2026-09-17 20:29:40 -05:00

..

admin_test.go

Require secrets via headers only: drop ?key= and ?password= query fallbacks (#137, #141)

2026-09-09 23:23:10 -05:00

admin.go

Require secrets via headers only: drop ?key= and ?password= query fallbacks (#137, #141)

2026-09-09 23:23:10 -05:00

adminratelimit_test.go

admin: per-IP rate limit (5/min) on admin key attempts (#66)

2026-09-09 09:15:01 -05:00

attachments_test.go

#38 iteration 1: file attachments, 1 file per paste

2026-09-09 22:21:15 -05:00

attachments.go

fix #221: scale image pastes, drop text box, fix raw view and size

2026-09-10 14:19:07 -05:00

burn_test.go

Remove ?token= deletion-token path (#143)

2026-09-10 08:37:07 -05:00

burn.go

Remove ?token= deletion-token path (#143)

2026-09-10 08:37:07 -05:00

burnrace_test.go

fix: atomic burn-after-read claim (#58)

2026-09-09 09:18:42 -05:00

burnreads_test.go

store: burn_after_reads>0 implies burn-after-read mode (#82)

2026-09-09 18:28:00 -05:00

cans_expiry_test.go

fix #60: clamp expires_in on cans API (400 on zero/negative, cap 1yr)

2026-09-09 09:13:21 -05:00

cans_flow_test.go

Require secrets via headers only: drop ?key= and ?password= query fallbacks (#137, #141)

2026-09-09 23:23:10 -05:00

cans_test.go

Require secrets via headers only: drop ?key= and ?password= query fallbacks (#137, #141)

2026-09-09 23:23:10 -05:00

cans.go

Require secrets via headers only: drop ?key= and ?password= query fallbacks (#137, #141)

2026-09-09 23:23:10 -05:00

clientip.go

Fix rate limiter bypass via client-controlled X-Forwarded-For (#280)

2026-09-17 20:29:40 -05:00

cookie_set_test.go

Fix #168: compact corner notification pill for paste creation

2026-09-10 11:24:24 -05:00

customslug_test.go

Refactor: split monolith into cmd/palette + internal/{store,api,web,lang} (#35)

2026-09-09 01:33:39 -05:00

delete_auth_test.go

Remove ?token= deletion-token path (#143)

2026-09-10 08:37:07 -05:00

guess.go

Refactor: split monolith into cmd/palette + internal/{store,api,web,lang} (#35)

2026-09-09 01:33:39 -05:00

issue68_validation_test.go

fix: input validation gaps (#68)

2026-09-09 09:21:25 -05:00

issue81_password_ratelimit_test.go

Require secrets via headers only: drop ?key= and ?password= query fallbacks (#137, #141)

2026-09-09 23:23:10 -05:00

issue86_field_bounds_test.go

Bound title and language at create time (#86)

2026-09-09 10:58:34 -05:00

issue105_errorcode_test.go

Result box: color-code by status + friendly error messages from error codes (#105)

2026-09-09 17:28:25 -05:00

issue138_cookie_test.go

#256: rename page URLs to match nav labels (/public, /saved)

2026-09-17 14:30:23 -05:00

issue235_type_test.go

#235: rename Language column to Type; attachment pastes show file extension

2026-09-10 17:13:37 -05:00

main_test.go

web: friendly Paste ID not found page for missing pastes (#173)

2026-09-10 11:06:52 -05:00

mine_test.go

#256: rename page URLs to match nav labels (/public, /saved)

2026-09-17 14:30:23 -05:00

pentest_cookie_test.go

Refactor: split monolith into cmd/palette + internal/{store,api,web,lang} (#35)

2026-09-09 01:33:39 -05:00

pentest_helpers_test.go

Refactor: split monolith into cmd/palette + internal/{store,api,web,lang} (#35)

2026-09-09 01:33:39 -05:00

pentest_rawct_test.go

Refactor: split monolith into cmd/palette + internal/{store,api,web,lang} (#35)

2026-09-09 01:33:39 -05:00

publicbool_test.go

#83: accept boolean public field in create API (false->unlisted, true->public)

2026-09-09 10:57:56 -05:00

ratelimit_test.go

Fix #205: strip whitespace-only text nodes between codeline blocks

2026-09-10 13:12:12 -05:00

ratelimit_xff_test.go

Fix rate limiter bypass via client-controlled X-Forwarded-For (#280)

2026-09-17 20:29:40 -05:00

ratelimit.go

Fix rate limiter bypass via client-controlled X-Forwarded-For (#280)

2026-09-17 20:29:40 -05:00

routes_rename_test.go

#256: rename page URLs to match nav labels (/public, /saved)

2026-09-17 14:30:23 -05:00

server.go

Fix rate limiter bypass via client-controlled X-Forwarded-For (#280)

2026-09-17 20:29:40 -05:00

slugrelease_test.go

Refactor: split monolith into cmd/palette + internal/{store,api,web,lang} (#35)

2026-09-09 01:33:39 -05:00

sweep33_test.go

Refactor: split monolith into cmd/palette + internal/{store,api,web,lang} (#35)

2026-09-09 01:33:39 -05:00

validate.go

#38 iteration 1: file attachments, 1 file per paste

2026-09-09 22:21:15 -05:00

viewdedupe_test.go

minor fixes: version label (#93), view dedupe tests (#95)

2026-09-09 16:40:53 -05:00