4 Commits

Author	SHA1	Message	Date
Jarian Cottingham	d37e14a2d9	security: block path traversal, SVG upload, duplicate defs; add tests, docs, license ... - Validate paste IDs against ^[a-f0-9]{16}$ before filesystem access (blocks read/delete traversal via crafted URLs) - Remove duplicate ALLOWED_IMAGE_EXTENSIONS that re-allowed SVG (XSS via stored SVG); keep magic-byte validation - Remove duplicate cleanup thread (two background loops were started) - Unknown expiry keys now default to 1 day instead of never - request.secure -> request.is_secure (werkzeug 3.x) - Add gunicorn to requirements (Dockerfile CMD referenced it) - 11 unit tests, ruff clean, MIT LICENSE, full README (was empty)	2026-08-20 21:26:54 +00:00
Jarian Cottingham	3bc5c16c5d	fix: HSTS (#29), CSP (#30), server version (#34), favicon (#35), aria (#36,#37), cleanup loop (#1), startup dirs (#16), health check (#27), docker-compose (#19,#20) ... - Add HSTS, CSP headers, remove Server header, fix GIF magic tuple - Add ARIA landmarks, button labels, inline SVG favicon - Scheduled cleanup loop (every 5min), /health endpoint - Remove docker-compose version field, unused named volumes - Move ensure_dirs to startup, remove duplicate definitions	2026-07-05 04:32:07 +00:00
Jarian Cottingham	3ea2ab4258	fix: security hardening — SECRET_KEY, CSRF, rate-limit, headers, Docker, SVG (#7,#8,#9,#10,#11,#12,#13,#14,#15,#18,#21,#25) ... Use secrets.token_hex for SECRET_KEY (no hardcoded default). Add CSRF tokens to forms and cookie. Rate limit uploads: 10 per 60s per IP. Add security headers: CSP, X-Frame-Options, X-Content-Type-Options, HSTS, Referrer-Policy. Block SVG uploads (executable JS risk). Validate image content via magic bytes. Atomic file creation with O_EXCL (fixes TOCTOU race). Increase paste ID from 8→16 hex chars. Run cleanup_expired every 5min in background thread. Delete .txt files on paste deletion. Fix file upload tab (missing name attribute). Docker: add non-root user, pin dependency versions.	2026-07-04 04:57:15 +00:00
Jarian Cottingham	016914c6ca	Initial commit: PasteBin server (Flask, Docker, gunicorn)	2026-05-06 04:49:23 +00:00