Jarian Cottingham d37e14a2d9 security: block path traversal, SVG upload, duplicate defs; add tests, docs, license ...

- Validate paste IDs against ^[a-f0-9]{16}$ before filesystem access
  (blocks read/delete traversal via crafted URLs)
- Remove duplicate ALLOWED_IMAGE_EXTENSIONS that re-allowed SVG
  (XSS via stored SVG); keep magic-byte validation
- Remove duplicate cleanup thread (two background loops were started)
- Unknown expiry keys now default to 1 day instead of never
- request.secure -> request.is_secure (werkzeug 3.x)
- Add gunicorn to requirements (Dockerfile CMD referenced it)
- 11 unit tests, ruff clean, MIT LICENSE, full README (was empty)

2026-08-20 21:26:54 +00:00

..

test_app.py

security: block path traversal, SVG upload, duplicate defs; add tests, docs, license

2026-08-20 21:26:54 +00:00