diff --git a/README.md b/README.md index 8be40cf..636d05d 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ ![](docs/_assets/images/favpng_parrot-royalty-free-cartoon.png) -**NOTE**: httpaste is publicly hosted at [httpaste.it](http://httpaste.it) and as a hidden Tor service ([https://paste77ubkwxy4fqezffsmthxdh3xerwi72tlsw2mch7ecjhw2xn7iyd.onion](https://paste77ubkwxy4fqezffsmthxdh3xerwi72tlsw2mch7ecjhw2xn7iyd.onion)). +**NOTE**: httpaste is publicly hosted at [httpaste.it](http://httpaste.it) and as a [Tor Onion Service](https://community.torproject.org/onion-services/overview/) ([http://paste77ubkwxy4fqezffsmthxdh3xerwi72tlsw2mch7ecjhw2xn7iyd.onion](http://paste77ubkwxy4fqezffsmthxdh3xerwi72tlsw2mch7ecjhw2xn7iyd.onion)). Both services are to be considered evaluatory, as long as the source code is in pre-release. Regarding voidance of pre-release status, see [Open Issues](https://victorykit.atlassian.net/issues/?jql=project%20%3D%20HTTPASTE%20AND%20fixVersion%20in%20(1.1.0-beta%2C%201.2.0-beta%2C%201.3.0)), for more information. diff --git a/docs/README.rst b/docs/README.rst index 96f45f3..c7099d1 100644 --- a/docs/README.rst +++ b/docs/README.rst @@ -10,7 +10,7 @@ httpaste - versatile HTTP pastebin .. image:: _assets/images/favpng_parrot-royalty-free-cartoon.png .. note:: - httpaste is publicly hosted at `httpaste.it`_ and as a hidden Tor service (``_). + httpaste is publicly hosted at `httpaste.it`_ and as a `Tor Onion Service`_ (``_). Both services are to be considered evaluatory, as long as the source code is in pre-release. Regarding voidance of pre-release status, see `Open Issues`_, for more information. @@ -79,6 +79,8 @@ This program uses licensed third-party software. ARCHITECTURE CONTRIBUTING + +.. _Tor Onion Service: https://community.torproject.org/onion-services/overview/ .. _ix.io: http://ix.io/ .. _sprunge.us: http://sprunge.us .. _pygments: https://pygments.org/ diff --git a/docs/guide/backend.rst b/docs/guide/backend.rst index a09c3e9..a30917a 100644 --- a/docs/guide/backend.rst +++ b/docs/guide/backend.rst @@ -6,17 +6,17 @@ The backend can be configured within the `[backend]` section of the configuratio SQLite ------ -.. autoclass:: httpaste.backend.sqlite.Parameters +.. autoclass:: httpaste.backend.sqlite.Config :members: Filesystem ---------- -.. autoclass:: httpaste.backend.file.Parameters +.. autoclass:: httpaste.backend.file.Config :members: MySQL ----- -.. autoclass:: httpaste.backend.mysql.Parameters +.. autoclass:: httpaste.backend.mysql.Config :members: \ No newline at end of file diff --git a/samples/httpaste.it/docker-compose.yml b/samples/httpaste.it/docker-compose.yml index a334189..2150c79 100644 --- a/samples/httpaste.it/docker-compose.yml +++ b/samples/httpaste.it/docker-compose.yml @@ -1,4 +1,4 @@ -version: "3.3" +version: "3.4" services: httpaste: build: @@ -37,4 +37,4 @@ services: volumes: - ./tor/etc/tor/torrc:/etc/tor/torrc volumes: - system-shared: \ No newline at end of file + system-shared: diff --git a/samples/httpaste.it/httpd/Dockerfile b/samples/httpaste.it/httpd/Dockerfile index afcc50e..0dc9490 100644 --- a/samples/httpaste.it/httpd/Dockerfile +++ b/samples/httpaste.it/httpd/Dockerfile @@ -1,3 +1,14 @@ FROM httpd:2.4 -RUN apt-get update -y && apt-get install -y libapache2-mod-proxy-uwsgi \ No newline at end of file +RUN apt-get update -y && apt-get install -y \ + libapache2-mod-proxy-uwsgi \ + libapache2-mod-evasive \ + libapache2-mod-security2 + +RUN mkdir -p /usr/local/apache2/crs-tecmint + +ADD https://github.com/SpiderLabs/owasp-modsecurity-crs/archive/refs/tags/v3.2.0.tar.gz /usr/local/apache2/crs/master + +RUN cd /usr/local/apache2/crs && \ + tar -xzf master && \ + cp owasp-modsecurity-crs-3.2.0/crs-setup.conf.example owasp-modsecurity-crs-3.2.0/crs-setup.conf \ No newline at end of file diff --git a/samples/httpaste.it/httpd/usr/local/apache2/conf/httpd.conf b/samples/httpaste.it/httpd/usr/local/apache2/conf/httpd.conf index 4c5ead0..07c9156 100644 --- a/samples/httpaste.it/httpd/usr/local/apache2/conf/httpd.conf +++ b/samples/httpaste.it/httpd/usr/local/apache2/conf/httpd.conf @@ -16,6 +16,9 @@ LoadModule proxy_module modules/mod_proxy.so LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so LoadModule unixd_module modules/mod_unixd.so LoadModule access_compat_module modules/mod_access_compat.so +LoadModule security2_module /usr/lib/apache2/modules/mod_security2.so +LoadModule evasive20_module /usr/lib/apache2/modules/mod_evasive20.so + User www-data @@ -23,7 +26,23 @@ LoadModule access_compat_module modules/mod_access_compat.so ServerAdmin you@example.com +ServerSignature Off +ServerTokens Prod + + Include crs/owasp-modsecurity-crs-3.2.0/crs-setup.conf + Include crs/owasp-modsecurity-crs-3.2.0/rules/*.conf + + + + DOSHashTableSize 3097 + DOSPageCount 3 + DOSSiteCount 10 + DOSPageInterval 1 + DOSSiteInterval 1 + DOSBlockingPeriod 10 + DOSCloseSocket On + ErrorLog /proc/self/fd/2 @@ -58,6 +77,7 @@ ServerName 127.0.0.1 #ProxyPreserveHost On ServerName httpaste.it + ServerAlias localhost SetEnv proxy-sendchunks ProxyPass "/" "unix:/shared/uwsgi.sock|uwsgi://localhost/" diff --git a/src/httpaste/__init__.py b/src/httpaste/__init__.py index ab8c190..9a062cf 100755 --- a/src/httpaste/__init__.py +++ b/src/httpaste/__init__.py @@ -9,8 +9,6 @@ SYNOPSIS HTTP [POST|PUT|DELETE|GET] {url}paste/[public|private] - {url}ui - DESCRIPTION This program offers an HTTP interface for storing public and private data @@ -21,7 +19,7 @@ DESCRIPTION listed on any index, since it isn't technically possible (by design). All pastes are symetrically encrypted with an HMAC derived key using - {hmac_iterations} iterations and SHA-512 hashing, a server-side salt and a + {hmac_iterations} iterations and SHA-256 hashing, a server-side salt and a randomly generated password. Public paste's passwords are derived from their ids. Private paste's passwords are randomly generated and stored inside a symetrically encrypted personal database, with the encryption key @@ -115,12 +113,12 @@ EXAMPLES SEE ALSO - Documentation + Documentation Sources - Host (HTTPS) - (HTTP) + Host (HTTP) + (Onion) NOTES diff --git a/src/httpaste/controller/paste/__init__.py b/src/httpaste/controller/paste/__init__.py index bd0a076..08a74a1 100644 --- a/src/httpaste/controller/paste/__init__.py +++ b/src/httpaste/controller/paste/__init__.py @@ -100,11 +100,13 @@ def get(**kwargs): else: paste_model.remove(pid, backend.paste) + if encoding is not None: + data = data.decode(encoding) + if syntax is not None: data = highlight(data, str(syntax), formatter, linenos) - if encoding is not None: - data = data.decode(encoding) + return ConnexionResponse( status_code=200,