Repository navigation
Validate the paste id in cmdv:// deep links - #7
Merged
Merged
Conversation
The id was percent-decoded and interpolated into
DELETE {api}/clipboard/{id}, so a crafted link like
cmdv://paste?id=..%2F..%2Fsomething&key=x sent a CSRF-tokened DELETE to
any path on the API. Accept only 22-char base64url ShortGuids (what the
API issues) and a base64url key; decrypt_paste already enforces the
16-byte key length.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
parse_paste_deep_linkpercent-decoded theidparameter, andfetch_ciphertextput it straight intoDELETE {api}/clipboard/{id}. A craftedcmdv://paste?id=..%2F..%2F…link therefore sent a request, with a freshX-XSRF-TOKEN, to any path on the API. The impact is small, because the desktop client sends no auth on this call, but the id should never be able to leave/clipboard/.What changes
reveal.rs: a link is accepted only ifdecrypt_pastealready enforces the 16-byte key length.Anything else falls through to the existing "Ignoring unrecognized deep link" path.
Testing
..%2F…,abc%3Fx%3D1, a short id and a 23-character id;/or+;cargo test --locked: 52/52 pass.cmdv://link in a built app.🤖 Generated with Claude Code