poslop

poslop merged pull request poslop/palette#87

2026-09-09 15:59:21 +00:00

fix #84: security headers were silently dropped (set pre-handler)

poslop commented on issue poslop/palette#86

2026-09-09 15:58:54 +00:00

[pentest2] Unbounded title/language fields accepted and stored (50 KB title, arbitrary language strings)

Fixed in PR #91: title truncated to 200 chars, language validated against ^[a-zA-Z0-9+#-]{1,40}$ with a clear 400 otherwise. Regression tests included.

poslop created pull request poslop/palette#91

2026-09-09 15:58:45 +00:00

Bound title and language at create time (#86)

poslop pushed to fix-86-field-bounds at poslop/palette

2026-09-09 15:58:37 +00:00

389e4d333f Bound title and language at create time (#86)

poslop created branch fix-86-field-bounds in poslop/palette

2026-09-09 15:58:37 +00:00

poslop pushed to fix-81-password-ratelimit at poslop/palette

2026-09-09 15:58:21 +00:00

99a044e8a2 Rate-limit all password verification attempts (#81)

poslop created pull request poslop/palette#90

2026-09-09 15:58:21 +00:00

Rate-limit all password verification attempts (#81)

poslop created branch fix-81-password-ratelimit in poslop/palette

2026-09-09 15:58:21 +00:00

poslop created pull request poslop/palette#89

2026-09-09 15:58:08 +00:00

ratelimit: rightmost untrusted-hop-safe client IP (fixes #85)

poslop pushed to fix-85-xff at poslop/palette

2026-09-09 15:58:00 +00:00

3d1d5ee1fd ratelimit: key on rightmost X-Forwarded-For entry (fixes #85)

poslop created branch fix-85-xff in poslop/palette

2026-09-09 15:58:00 +00:00

poslop pushed to fix-83-public-false at poslop/palette

2026-09-09 15:57:57 +00:00

ccb22a2d28 #83: accept boolean public field in create API (false->unlisted, true->public)

poslop created branch fix-83-public-false in poslop/palette

2026-09-09 15:57:57 +00:00

poslop created pull request poslop/palette#88

2026-09-09 15:57:57 +00:00

Fix #83: create API ignores boolean public field

poslop commented on issue poslop/palette#81

2026-09-09 15:55:16 +00:00

[pentest2] Password-protected pastes: unauthenticated password guessing via GET query params bypasses rate limiting

Confirmed live on v0.2.1 dev: 8 consecutive wrong passwords via GET ?password= all returned 401 with zero 429s, then the correct password succeeded. The POST form path rate limits but the API…

poslop commented on issue poslop/palette#84

2026-09-09 15:54:44 +00:00

[pentest2] Missing security headers on HTML pages (no CSP, no X-Frame-Options, no X-Content-Type-Options, no Referrer-Policy)

Root-caused: the middleware set headers AFTER the handler ran. Page handlers flush template output immediately, so header mutations after WriteHeader are silently discarded (the unit test passed…

poslop closed issue poslop/palette#82

2026-09-09 15:54:44 +00:00

[pentest2] burn_after_reads is never enforced: paste content remains readable indefinitely

poslop commented on issue poslop/palette#82

2026-09-09 15:54:43 +00:00

[pentest2] burn_after_reads is never enforced: paste content remains readable indefinitely

Not a bug as reported. burn_after_reads (plural) is the budget for burn-after-N and only takes effect when burn_after_read: true is also set (store.CreatePaste: `if p.BurnAfterRead { ...…

poslop pushed to fix-84-headers-prewrite at poslop/palette

2026-09-09 15:54:18 +00:00

3d415edbdc fix #84: security headers dropped because they were set post-flush; set pre-handler

poslop created branch fix-84-headers-prewrite in poslop/palette

2026-09-09 15:54:18 +00:00