d37e14a2d9
security: block path traversal, SVG upload, duplicate defs; add tests, docs, license
...
CI / lint (push) Waiting to run
CI / test (push) Waiting to run
CI / docker-build (push) Waiting to run
CI / security (push) Waiting to run
CI / build-result (push) Blocked by required conditions
- Validate paste IDs against ^[a-f0-9]{16}$ before filesystem access
(blocks read/delete traversal via crafted URLs)
- Remove duplicate ALLOWED_IMAGE_EXTENSIONS that re-allowed SVG
(XSS via stored SVG); keep magic-byte validation
- Remove duplicate cleanup thread (two background loops were started)
- Unknown expiry keys now default to 1 day instead of never
- request.secure -> request.is_secure (werkzeug 3.x)
- Add gunicorn to requirements (Dockerfile CMD referenced it)
- 11 unit tests, ruff clean, MIT LICENSE, full README (was empty)
2026-08-20 21:26:54 +00:00
9ff745f3dd
Merge pull request 'Fix security headers, ARIA, cleanup, health check, docker-compose' ( #39 ) from fix/security-and-ope into main
2026-07-04 23:32:23 -05:00
3bc5c16c5d
fix: HSTS ( #29 ), CSP ( #30 ), server version ( #34 ), favicon ( #35 ), aria (#36,#37), cleanup loop ( #1 ), startup dirs ( #16 ), health check ( #27 ), docker-compose (#19,#20)
...
- Add HSTS, CSP headers, remove Server header, fix GIF magic tuple
- Add ARIA landmarks, button labels, inline SVG favicon
- Scheduled cleanup loop (every 5min), /health endpoint
- Remove docker-compose version field, unused named volumes
- Move ensure_dirs to startup, remove duplicate definitions
2026-07-05 04:32:07 +00:00
a494cab34f
Merge pull request 'CI: remove --no-cache for docker layer caching' ( #38 ) from ci-fix-nocache into main
...
Reviewed-on: https://git.example.com/jarianc/paste-bin/pulls/38
2026-07-04 22:23:38 -05:00
59fc75fd1b
CI: remove --no-cache for docker layer caching
2026-07-05 03:13:43 +00:00
48507f4067
CI: add generalized workflow
2026-07-05 02:46:36 +00:00
3ea2ab4258
fix: security hardening — SECRET_KEY, CSRF, rate-limit, headers, Docker, SVG (#7,#8,#9,#10,#11,#12,#13,#14,#15,#18,#21,#25)
...
Use secrets.token_hex for SECRET_KEY (no hardcoded default).
Add CSRF tokens to forms and cookie.
Rate limit uploads: 10 per 60s per IP.
Add security headers: CSP, X-Frame-Options, X-Content-Type-Options, HSTS, Referrer-Policy.
Block SVG uploads (executable JS risk).
Validate image content via magic bytes.
Atomic file creation with O_EXCL (fixes TOCTOU race).
Increase paste ID from 8→16 hex chars.
Run cleanup_expired every 5min in background thread.
Delete .txt files on paste deletion.
Fix file upload tab (missing name attribute).
Docker: add non-root user, pin dependency versions.
2026-07-04 04:57:15 +00:00
2774a748bc
update local changes
2026-07-03 01:14:04 +00:00
016914c6ca
Initial commit: PasteBin server (Flask, Docker, gunicorn)
2026-05-06 04:49:23 +00:00
63ee936f3d
first commit
2026-05-06 04:43:05 +00:00
