adamoutler/pastebin repository overview

⁠Hastebin Plus (hackedyour.info)

Hastebin Plus is a lightweight, security-hardened pastebin written in Node.js for sharing plain text, code, logs, and Markdown documents. It is based on haste⁠ and Hastebin Plus⁠, enhanced for speed, simplicity, and zero-execution client-side Markdown rendering.

⁠Docker

git clone https://github.com/adamoutler/pastebin.git
cd pastebin
docker build -t pastebin .
docker run --name pastebin \
  -v pastebin-pastes:/opt/pastebin/data \
  -v pastebin-images:/opt/pastebin/static/images \
  -p 7777:7777 \
  -d pastebin

⁠Features

• Plain Text & Code Pastes: Fast dark-mode viewer with line numbers, raw paste endpoint (/raw/:id), and one-key duplication (Ctrl + D).
• Automatic Client-Side Markdown Detection & Rendering:
  • Automatically detects Markdown documents (headings, fenced code blocks, GFM tables, bulleted/numbered/task lists, blockquotes) without false positives on source code, scripts, JSON, YAML, or diffs.
  • Normalized pastebin typography in dark mode with gray text (#839496) on a black (#000) background and subtle charcoal code blocks (#0c0c0c).
  • Toggle between rendered Markdown and plain text at any time via the MD toolbar button or Ctrl + Shift + M.
• Writing Mode Live Preview: Switch between Write and Preview before saving (Ctrl + S).
• Zero Client-Side Execution Architecture:
  • Pure Token-to-DOM rendering (document.createElement + textContent only; zero innerHTML, outerHTML, or .html() sinks).
  • Raw HTML and <script> tags inside pastes are rendered strictly as inert literal text.
  • Image syntax ![alt](url) is preserved literally as plain text so zero external or internal image requests fire automatically.
  • Links ([label](url)) enforce an explicit protocol allowlist (https:, http:, mailto:, #anchor) with rel="noopener noreferrer nofollow".
  • Server-side Content-Security-Policy, X-Content-Type-Options: nosniff, Referrer-Policy: no-referrer, and X-Frame-Options: DENY headers.
• OpenGraph Image Previews: Automatically generates preview images (/images/:id.png) for shared links.

⁠Keyboard Shortcuts

⁠Installation (Bare Metal)

1. Clone this repository: git clone https://github.com/adamoutler/pastebin.git
2. Open config.js and adjust settings if needed.
3. Install dependencies: npm ci
4. Run security and unit tests: npm test
5. Start the application: npm start

⁠Settings (config.js)

⁠Default Config

{
    "host": "0.0.0.0",
    "port": 7777,
    "dataPath": "./data",
    "keyLength": 16,
    "maxLength": 5000000,
    "staticMaxAge": 86400,
    "compressStaticAssets": true,
    "documents": {
        "about": "./README.md"
    }
}

⁠Testing

npm test
pytest -v test_server.py

⁠Authors

• Adam Outler⁠
• Hastebin Plus⁠: Marvin Menzerath
• haste⁠: John Crepezzi - MIT License
• jQuery⁠: MIT License
• highlight.js⁠: Ivan Sagalaev - License⁠

⁠License

Copyright (C) 2014 Marvin Menzerath

This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more details.

You should have received a copy of the GNU Affero General Public License along with this program. If not, see http://www.gnu.org/licenses/⁠.