Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Brute force] Prevent brute force query on sprunge #52

Open
trinhnx opened this issue Oct 27, 2022 · 1 comment
Open

[Brute force] Prevent brute force query on sprunge #52

trinhnx opened this issue Oct 27, 2022 · 1 comment

Comments

@trinhnx
Copy link

trinhnx commented Oct 27, 2022

[Given]
Sprunge is simple, get content then push, an URL is returned and that's it. It's quick.
But now there is no way to control the content which is already pushed.

[Problem]
The returned URL is simple and short enough for an attacker to write a simple create to crawl it all.
I do not see any threshold limit or any mechanism related to prevent such dangerous action.

@zzo38
Copy link

zzo38 commented Sep 26, 2023

An advantage of a short URL is that you can easily write it down quickly. A disadvantage is what you describe. Using a cryptographic hash (e.g. SHA-3) instead would make it longer (and would lose the advantage of writing it down quickly), but avoids that problem as well as allowing to check for duplicates easily and you can verify the data easily enough (that it has not been tampered with) once you have the URL.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants