Jarian Cottingham
d37e14a2d9
- Validate paste IDs against ^[a-f0-9]{16}$ before filesystem access
(blocks read/delete traversal via crafted URLs)
- Remove duplicate ALLOWED_IMAGE_EXTENSIONS that re-allowed SVG
(XSS via stored SVG); keep magic-byte validation
- Remove duplicate cleanup thread (two background loops were started)
- Unknown expiry keys now default to 1 day instead of never
- request.secure -> request.is_secure (werkzeug 3.x)
- Add gunicorn to requirements (Dockerfile CMD referenced it)
- 11 unit tests, ruff clean, MIT LICENSE, full README (was empty)
43 lines
937 B
TOML
43 lines
937 B
TOML
[project]
|
|
name = "paste-bin"
|
|
version = "1.0.0"
|
|
description = "Minimal security-focused paste bin: text, image, and file sharing with expiring links"
|
|
readme = "README.md"
|
|
requires-python = ">=3.9"
|
|
license = { text = "MIT" }
|
|
authors = [{ name = "Jarian Cottingham", email = "jarianc@proton.me" }]
|
|
keywords = ["paste", "paste-bin", "sharing", "flask"]
|
|
classifiers = [
|
|
"License :: OSI Approved :: MIT License",
|
|
"Programming Language :: Python :: 3",
|
|
]
|
|
dependencies = [
|
|
"flask>=3.0,<4.0",
|
|
"werkzeug>=3.0,<4.0",
|
|
]
|
|
|
|
[project.optional-dependencies]
|
|
dev = [
|
|
"pytest>=7.0",
|
|
"ruff>=0.1.0",
|
|
]
|
|
|
|
[build-system]
|
|
requires = ["setuptools>=61.0"]
|
|
build-backend = "setuptools.build_meta"
|
|
|
|
[tool.setuptools]
|
|
py-modules = ["app"]
|
|
|
|
[tool.ruff]
|
|
line-length = 120
|
|
target-version = "py39"
|
|
exclude = [".git", "uploads", "store"]
|
|
|
|
[tool.ruff.lint]
|
|
select = ["E", "F", "W"]
|
|
ignore = ["E501"]
|
|
|
|
[tool.pytest.ini_options]
|
|
testpaths = ["tests"]
|