43 Commits

Author	SHA1	Message	Date
Username	8ebabfe102	pastes: add display_name field ... Authenticated users can tag pastes with a human-readable label via X-Display-Name header. Supports create, update, remove, and listing. Max 128 chars, control characters rejected.	2026-02-24 12:55:44 +01:00
Username	2679bc8e69	docs: add url shortener documentation	2026-02-16 20:56:55 +01:00
Username	60652e96b4	containerfile: consolidate to single alpine image	2026-01-21 12:17:47 +01:00
Username	79a4d1d0ea	docs: add k1s quick deploy section	2026-01-21 10:35:11 +01:00
Username	e0310339ee	docs: update for k3s deployment and harbor.mymx.me	2026-01-18 17:07:49 +01:00
Username	9eee14e918	docs: update harbor integration status and remove hardcoded credentials	2026-01-18 09:57:27 +01:00
Username	a736bce346	docs: add kubernetes deployment guide	2026-01-17 16:27:56 +01:00
Username	7812af2e47	docs: add harbor registry guide	2026-01-17 16:27:51 +01:00
Username	6da80aec76	docs: update for simplified MIME detection (v1.5.1)	2025-12-26 19:52:40 +01:00
Username	fb45005766	add polyglot generator and MIME confusion tests ... - polyglot_generator.py: creates files valid in multiple formats - 41 new tests verify MIME detection handles polyglots correctly - Document rate limiting behavior under attack - Clarify DMG/ISO/DOCX detection limitations	2025-12-26 18:25:46 +01:00
Username	98694ba1cc	docs: add comprehensive threat model ... STRIDE analysis covering: - System architecture and trust boundaries - Attack surface analysis (10 entry points) - Threat actors (anonymous, authenticated, operator, sophisticated) - 20+ threats with mitigations across STRIDE categories - Security controls matrix - MIME polyglot attack mitigations - Cryptographic controls - Residual risks and known limitations - Incident response guidance	2025-12-26 17:10:41 +01:00
Username	dc2da67fb3	add Hypothesis property-based MIME detection tests ... - test_magic_prefix_detection: verify all signatures with random suffix - test_random_binary_never_crashes: random data never crashes - test_partial_magic_no_false_match: truncated magic handled safely - test_magic_not_at_start_ignored: only detect magic at offset 0	2025-12-26 17:09:02 +01:00
Username	03bcb157cc	add HEIC/HEIF/AVIF MIME detection signatures ... - Add ftyp box signatures for heic, mif1, and avif brands - Add tests for new image formats - Fix nested if lint warning in lookup rate limit - Update security docs: MKV uses WebM header, TAR needs offset 257	2025-12-26 17:04:51 +01:00
Username	93a4dd2f97	ci: add security headers audit to pipeline	2025-12-26 16:56:03 +01:00
Username	bd75f81afd	add security testing suite and update docs ... - tests/security/pentest_session.py: comprehensive 10-phase pentest - tests/security/profiled_server.py: cProfile-enabled server - tests/security/cli_security_audit.py: CLI security checks - tests/security/dos_memory_test.py: memory exhaustion tests - tests/security/race_condition_test.py: concurrency tests - docs: add pentest results, profiling analysis, new test commands	2025-12-26 00:39:33 +01:00
Username	c1d2e39b09	docs: complete penetration testing status update ... All pentest items now complete: - CLI security audit (clipboard, permissions) - DoS memory exhaustion (fixed lookup rate limit) - Race conditions (all protected by locks)	2025-12-26 00:17:11 +01:00
Username	0fa6052f69	docs: update security testing status with completed tests ... - Add race condition testing results (HEAD triggers burn-after-read) - Add timing attack analysis (PBKDF2 constant-time verified) - Mark RPM, AVI, WAV MIME signatures as fixed - Update security controls table with new verifications	2025-12-25 23:58:42 +01:00
Username	4823ff7b5d	docs: update MIME testing results (26 signatures tested)	2025-12-25 23:37:05 +01:00
Username	645f6feefd	docs: add security testing status and remaining tasks	2025-12-25 23:04:33 +01:00
Username	da36f15741	docs: add fuzzer results to security assessment	2025-12-25 22:52:43 +01:00
Username	ff05f1b289	docs: add MIME detection security assessment	2025-12-25 22:21:35 +01:00
Username	764b831bb0	expand magic byte detection for common file formats ... Add detection for: - Images: BMP, TIFF, ICO - Video: MP4, WebM, FLV, Matroska - Audio: MP3, FLAC, OGG - Documents: MS Office OLE (DOC/XLS/PPT) - Executables: PE (EXE/DLL), ELF, Mach-O, WASM - Archives: BZIP2, XZ, ZSTD, LZ4, 7z, RAR - Data: SQLite This improves REQUIRE_BINARY enforcement by detecting more recognizable formats that should be encrypted before upload.	2025-12-25 19:47:33 +01:00
Username	14c8d0d83d	docs: update test count and fix pki.md inaccuracies ... - README: update test count from 283 to 337 - pki.md: fix environment variable names (PKI_CA_PASSWORD) - pki.md: correct CLI usage examples (config via env/file) - pki.md: update pki status output format - pki.md: clarify revocation is API-only (no CLI command)	2025-12-25 19:24:17 +01:00
Username	debdc8478e	add hypothesis-based fuzzing test suite ... 18 property-based tests covering: - Content handling (binary, text, unicode) - Paste ID validation and path traversal - Header fuzzing (auth, proxy, XFF) - JSON endpoint fuzzing - Size limit enforcement - Injection detection (SQLi, SSTI, XSS) - Error handling paths	2025-12-25 19:20:16 +01:00
Username	0aa31c526b	docs: add PKI usage guide with examples	2025-12-25 00:28:33 +01:00
Username	89eee3378a	security: implement pentest remediation (PROXY-001, BURN-001, RATE-001) ... PROXY-001: Add startup warning when TRUSTED_PROXY_SECRET empty in production - validate_security_config() checks for missing proxy secret - Additional warning when PKI enabled without proxy secret - Tests for security configuration validation BURN-001: HEAD requests now trigger burn-after-read deletion - Prevents attacker from probing paste existence before retrieval - Updated test to verify new behavior RATE-001: Add RATE_LIMIT_MAX_ENTRIES to cap memory usage - Default 10000 unique IPs tracked - Prunes oldest entries when limit exceeded - Protects against memory exhaustion DoS Test count: 284 -> 291 (7 new security tests)	2025-12-24 21:42:15 +01:00
Username	4577a1d7e4	docs: update for systemd and rate limit headers	2025-12-24 20:05:30 +01:00
Username	cf458347ef	add systemd service unit and rate limit headers ... Systemd deployment: - examples/flaskpaste.service with security hardening - examples/flaskpaste.env with all config options - README deployment section updated Rate limit headers (X-RateLimit-*): - Limit, Remaining, Reset on 201 and 429 responses - Per-IP tracking with auth multiplier - api.md documented	2025-12-24 17:51:14 +01:00
Username	cb6eebee59	docs: update for v1.5.0 features ... - Add PKI audit logging, request duration metrics to features list - Update test count from 216 to 283 - Add audit.py and metrics.py to project structure - Document audit logging in api.md - Update TASKLIST.md with completed tasks - Update TODO.md (remove resolved debt items) - Update ROADMAP.md decision log	2025-12-24 17:10:42 +01:00
Username	028367d803	docs: modernize and clean deprecated content ... - replace deprecated FLASK_ENV with FLASK_DEBUG - remove duplicate FLASKPASTE_MAX_EXPIRY entry - update API version to 1.5.0 - add missing /pastes and /pki endpoints to table - remove deprecated X-XSS-Protection header - add PKI config variables - update features list with current capabilities - update auth benefits and security sections	2025-12-21 22:36:48 +01:00
Username	e2e2039903	docs: update for tiered expiry, admin features, batch delete	2025-12-21 22:16:51 +01:00
Username	880bf631e3	fpaste: add register command for public certificate enrollment ... - Add register command to obtain client cert from server - Solve PoW challenge, receive PKCS#12 bundle - Extract cert/key, optionally update config (--configure) - Fix registration to work without PKI_ENABLED (only needs PKI_CA_PASSWORD) - Add skip_enabled_check param to get_ca_info() for registration path - Update docs: README examples, API header name fix (X-Fingerprint-SHA1)	2025-12-21 10:59:09 +01:00
Username	5849c7406f	add /register endpoint for public certificate registration ... Public endpoint allows anyone to obtain a client certificate for authentication. Features: - Higher PoW difficulty than paste creation (24 vs 20 bits) - Auto-generates CA on first registration if not present - Returns PKCS#12 bundle with cert, key, and CA - Configurable via FLASKPASTE_REGISTER_POW Endpoints: - GET /register/challenge - Get registration PoW challenge - POST /register - Register and receive PKCS#12 bundle	2025-12-21 10:34:02 +01:00
Username	b47c26dd14	docs: update for v1.4.0 features ... - Add anti-flood, rate limiting, scheduled cleanup to feature lists - Update version to 1.4.0, test count to 205 - Document /pastes endpoint with query parameters - Add anti-flood fields to /challenge response - Update CLI docs with new commands (list, search, export) - Add decision log entries for recent features	2025-12-20 21:36:09 +01:00
Username	a2c5a013ef	docs: update for encrypt-by-default CLI ... Update README.md, api.md, and error hints to reflect: - encryption is now default (no -e flag needed) - use -E/--no-encrypt to disable - file path shortcut (fpaste file.txt)	2025-12-20 18:12:00 +01:00
Username	cdf8de5a8b	document encryption enforcement options	2025-12-20 17:46:58 +01:00
Username	4e38517faf	pki: add minimal certificate authority ... - CA generation with encrypted private key storage (AES-256-GCM) - Client certificate issuance with configurable validity - Certificate revocation with status tracking - SHA1 fingerprint integration with existing mTLS auth - API endpoints: /pki/status, /pki/ca, /pki/issue, /pki/revoke - CLI commands: fpaste pki status/issue/revoke - Comprehensive test coverage	2025-12-20 17:20:15 +01:00
Username	7deba711d4	entropy: exempt small content from check ... Small data has unreliable entropy measurement due to sample size. MIN_ENTROPY_SIZE (default 256 bytes) sets the threshold.	2025-12-20 08:48:13 +01:00
Username	8addf2d9e8	add entropy enforcement for optional encryption requirement ... Shannon entropy check rejects low-entropy content when MIN_ENTROPY > 0. Encrypted data ~7.5-8.0 bits/byte, plaintext ~4.0-5.0 bits/byte. Configurable via FLASKPASTE_MIN_ENTROPY environment variable.	2025-12-20 06:57:50 +01:00
Username	c76a158c18	bump version to 1.1.0, centralize VERSION constant	2025-12-20 04:21:06 +01:00
Username	ccfd8509cc	docs: add pow, cli client, and head method documentation	2025-12-20 04:09:08 +01:00
Username	202e927918	add content-hash dedup for abuse prevention ... Throttle repeated submissions of identical content using SHA256 hash tracking. Configurable via FLASKPASTE_DEDUP_WINDOW and FLASKPASTE_DEDUP_MAX.	2025-12-20 03:31:20 +01:00
Username	8f9868f0d9	flaskpaste: initial commit with security hardening ... Features: - REST API for text/binary pastes with MIME detection - Client certificate auth via X-SSL-Client-SHA1 header - SQLite with WAL mode for concurrent access - Automatic paste expiry with LRU cleanup Security: - HSTS, CSP, X-Frame-Options, X-Content-Type-Options - Cache-Control: no-store for sensitive responses - X-Request-ID tracing for log correlation - X-Proxy-Secret validation for defense-in-depth - Parameterized queries, input validation - Size limits (3 MiB anon, 50 MiB auth) Includes /health endpoint, container support, and 70 tests.	2025-12-16 04:42:18 +01:00