Jarian Cottingham
3ea2ab4258
Use secrets.token_hex for SECRET_KEY (no hardcoded default). Add CSRF tokens to forms and cookie. Rate limit uploads: 10 per 60s per IP. Add security headers: CSP, X-Frame-Options, X-Content-Type-Options, HSTS, Referrer-Policy. Block SVG uploads (executable JS risk). Validate image content via magic bytes. Atomic file creation with O_EXCL (fixes TOCTOU race). Increase paste ID from 8→16 hex chars. Run cleanup_expired every 5min in background thread. Delete .txt files on paste deletion. Fix file upload tab (missing name attribute). Docker: add non-root user, pin dependency versions.
20 lines
373 B
Docker
20 lines
373 B
Docker
FROM python:3.12-slim
|
|
|
|
WORKDIR /app
|
|
|
|
COPY requirements.txt .
|
|
RUN pip install --no-cache-dir -r requirements.txt
|
|
|
|
COPY . .
|
|
|
|
RUN mkdir -p /app/uploads /app/store && \
|
|
adduser --disabled-password --no-create-home appuser && \
|
|
chown -R appuser:appuser /app
|
|
|
|
USER appuser
|
|
|
|
EXPOSE 8080
|
|
|
|
ENV PORT=8080
|
|
|
|
CMD gunicorn --bind 0.0.0.0:${PORT} --workers 4 --timeout 120 app:app |