Rustypaste is a minimal file upload/pastebin service.

Fixes orhun/rustypaste#13

The default landing page is set as a const in the binary, but is configurable with the server.landing_page key. Should the key be in another section (i.e. not [server]? Handling is added for when the config file doesn't have any landing page. I updated the default config.toml.

Hello,

I'm really liking the very minimalist-style setup of rustypaste so far. It's so much faster than everything else I've tried lately.

I am curious if we could get some more documentation about how to use the authentication portion of rustypaste. How do we setup authentication on the server side? I think the documentation on how to use the authentication on the client side is clear but we'll find out once I figure out how to setup the server side authentication.

Thanks!

Currently you need to run an outside command to make sure expired files are actually deleted. Couldn't this step be easily performed by the server itself during runtime so you don't need to add the complexity of having a second thing that modifies the files?

First of all, thanks for this, looks really useful.

I've packaged it and might make a nixos module out of this, but I have a small suggestion if you'd consider; cmdline arguments/parameters. Configuration options are not too many, so it might be helpful to override a 'default configuration' via arguments. Plus it can help later probably, e.g. having a --version.

Hello, I would like to know if someone that has successufully installed RustPaste in Docker, experienced the same as me.

When, I launch the container, it simply redirects the webui to the GitHub repo (orhun/rustypaste).

Note: I used the config.toml file as it is, didn't modified anything. All things related to port redirection and so on, I do that via command.

What could be happening here?

Show a cool 😎 landing page instead of redirecting to the repository when / is visited.

Some ideas:

• http://ix.io/ (man page style)
• https://0x0.st/ (something simple)

Hi again,

I realized when same file uploaded twice, takes twice amount of place on the server. Just as an idea (possible with a strong-enough-to-trust hashing):

Hardlinks can be used on server side and/or client side can send the hash before uploading file to the server (and it can return the same/a brand new URL). This might save some bandwidth & disk space.

Of course there is security side of the things, like guessing attacks etc, but whole thing can be optional depending on the use case.

this PR was intended to fix #8 but after checking, I found that this crate is already on 2021.. so I decided to run a cargo update in order to contribute at least something :)

curl localhost:8000 -X POST -F "file=;filename=../." will upload the data to the parent directory of upload. An attacker doesn't seem to have direct control over the filename given (unless random_url is disabled, in which case they can freely overwrite any file the web server has access to!), other than the extension, so they probably can't use this to overwrite important files, but this is still bad.

In upload, you're loading in the full content of the file to memory, and then checking if it is too big. You should be checking the size while downloading, and immediately rejecting a file that is too big.

Steps to reproduce:

curl localhost:8000 -X POST -F file=@/dev/zero and watch as the process uses all your system's memory despite having a max_content_length of 10MB.

It would be nice to know the server version with a special endpoint like /version.

One downside might be that it should be configurable with a flag in the configuration file or only accessible when auth_token is present since system admin might not want to publicly expose the server version due to security concerns.

Other ideas are appreciated.

Even though the names of uploaded files are random, fuzzer utilities can be used to discover content on the server.

Related questions are:

• How can rustypaste be affected by such situation?
  • Need a demonstration of fuzzing with rustbuster or a similar tool.
• Should there be any precautions for preventing this?
  • Implement blocking user-agents for common fuzzer tools (?)
• Should we do anything?

I think it is an interesting topic and needs some brainstorming for improving security.

Hello,

Is there a way to force the file to be downloaded when a file type has the MIME override enabled for that type? I want to be able to share the link to a file that would play in the browser (like .mp4) but also share a link that will auto-download as well (like with a flag in the URL or something similar). I thought I had seen this feature somewhere in this project but can't seem to find any documentation on it if it does exist.

Thanks!

Hello,

I would like to be able to upload folders at a time instead of just individual files. Am curious if there is any capacity/support for such a thing especially because it seems as though you can supply multiple files when using curl.

Thanks!

net2 crate has been deprecated; use socket2 instead

| Details | | | ------------------- | ---------------------------------------------- | | Status | unmaintained | | Package | net2 | | Version | 0.2.37 | | URL | https://github.com/deprecrated/net2-rs/commit/3350e3819adf151709047e93f25583a5df681091 | | Date | 2020-05-01 |

The net2 crate has been deprecated and users are encouraged to considered socket2 instead.

See advisory page for additional details.