fix: validate Content-Length + add paste expiry/TTL #3

Merged

everestmcarthur merged 1 commit from fix/content-length-and-paste-ttl into main

2026-05-19 10:44:32 -04:00

Author	SHA1	Message	Date
Viktor	d77c14b328	fix: validate Content-Length + add paste expiry/TTL Fixes #1 and #2: 1. Content-Length validation (security): - Reject negative Content-Length values that cause rfile.read(-1) to hang - Handle non-integer Content-Length gracefully 2. Paste expiry / TTL: - Add expires_at column to pastes table - Default TTL: 30 days (configurable via --max-age or FORGE_PASTE_MAX_AGE) - Opportunistic cleanup on each paste creation (at most once/hour) - Expired pastes excluded from reads immediately - Auto-migration for existing databases (backfills expiry on existing pastes) - Expiry info shown in paste viewer UI - --max-age 0 disables expiry entirely Closes #1 Closes #2	2026-05-19 11:17:01 +00:00

Author

SHA1

Message

Date

Viktor

d77c14b328

fix: validate Content-Length + add paste expiry/TTL

Fixes #1 and #2:

1. Content-Length validation (security):
   - Reject negative Content-Length values that cause rfile.read(-1) to hang
   - Handle non-integer Content-Length gracefully

2. Paste expiry / TTL:
   - Add expires_at column to pastes table
   - Default TTL: 30 days (configurable via --max-age or FORGE_PASTE_MAX_AGE)
   - Opportunistic cleanup on each paste creation (at most once/hour)
   - Expired pastes excluded from reads immediately
   - Auto-migration for existing databases (backfills expiry on existing pastes)
   - Expiry info shown in paste viewer UI
   - --max-age 0 disables expiry entirely

Closes #1
Closes #2

2026-05-19 11:17:01 +00:00