{"id":5633,"date":"2026-09-03T13:08:06","date_gmt":"2026-09-03T13:08:06","guid":{"rendered":"https:\/\/anasalassi.com\/projects\/paste-studio\/"},"modified":"2026-09-03T13:08:06","modified_gmt":"2026-09-03T13:08:06","slug":"paste-studio","status":"publish","type":"page","link":"https:\/\/anasalassi.com\/ar\/projects\/paste-studio\/","title":{"rendered":"Paste Studio \u2014 \u0623\u062f\u0627\u0629 \u062a\u0646\u0632\u064a\u0644 \u0627\u0644\u0648\u0633\u0627\u0626\u0637 \u0648\u0645\u0639\u0627\u0644\u062c\u0629 \u0627\u0644\u0635\u0648\u0631"},"content":{"rendered":"\t\t
\n\t\t\t\t<\/span>
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t<\/svg>All projects<\/a>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t<\/span>Live Demo<\/span>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t

Paste Studio \u2014 Social Media Downloader & Image Toolkit<\/h1>\t\t\t\t<\/div>\n\t\t<\/span>\t\t
\n\t\t\t\t\t\t\t\t\t

A privacy-conscious media workspace for pasting, converting, resizing, optimising, and downloading authorised content through one streamlined bilingual experience.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t
Role<\/dt>
Product design and full-stack delivery<\/dd><\/div>
Category<\/dt>
Media utility<\/dd><\/div>
Status<\/dt>
Live public demo<\/dd><\/div>
Stack<\/dt>
PHP 8.3 · Canvas API · no framework<\/dd><\/div><\/dl>\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\tTry Live Demo<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\tBook a Call<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\"Paste
One input area accepts a clipboard paste, a drop, a file picker, the camera, or a link.<\/figcaption><\/figure>\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Overview<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Paste Studio turns a clipboard image into a finished file in as few steps as possible, and tells the truth about what it can do with a social-media link. Images are converted, resized, cropped, optimised and stripped of metadata entirely inside the browser. Links are inspected through each platform’s own public interfaces \u2014 nothing is scraped and no protection is circumvented.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

The problem<\/h3>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t
  • Resizing one image for four networks means four tools or a heavyweight editor.<\/li>
  • Most \u201cdownloader\u201d sites are advertising traps with fake download buttons.<\/li>
  • Uploading a private screenshot to an unknown server to crop it is a poor trade.<\/li>
  • Photos carry EXIF and GPS that people publish without realising.<\/li>
  • Tools promise formats and qualities the source never had.<\/li><\/ul>\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
    \n\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    What Paste Studio does<\/h3>\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t\t
    • Presets for every major network, in one place.<\/li>
    • No advertising, no fake buttons, no dark patterns.<\/li>
    • Images never leave the browser \u2014 there is nothing to upload.<\/li>
    • Metadata is dropped by default, and the interface says so.<\/li>
    • It states plainly what is and is not possible, per platform.<\/li><\/ul>\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
      \n\t\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t

      My role<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t

      Everything: the product decision about what to build and what to refuse, the brand and interface, the Arabic and English content, the client-side image engine, the SSRF-hardened link service, the test suites, the server configuration, and the deployment.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

      \n\t\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t

      The decision that shaped the product<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t

      The original brief asked for YouTube and social-media downloads. Building that means using a tool like yt-dlp, which works by deciphering YouTube’s signature and throttling parameters. That is circumventing a technical protection measure, and it breaks terms that bind the operator<\/em> of the service \u2014 a checkbox from a visitor cannot waive them.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t\t\t\t\t\t

      So Paste Studio does not download video or audio streams. Instead it uses each platform’s own public oEmbed endpoint for metadata, relays the thumbnails they already publish as ordinary images, offers the official embed code, and points content owners at the platform’s own download. The Supported Platforms page states this in a table rather than burying it.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t\t\t\t\t\t

      That constraint turned out to be the product’s strength. With no media pipeline there is no job queue, no temporary media on disk, no cleanup to get wrong, and no retention question to answer carefully \u2014 because nothing is retained.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

      \n\t\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t

      The journey<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t\t
      1. Paste or upload<\/strong>Clipboard, drag and drop, file picker, mobile camera, or a link.<\/span><\/li>
      2. Preview<\/strong>Type, dimensions, file size, transparency, EXIF presence \u2014 before anything is changed.<\/span><\/li>
      3. Choose<\/strong>A preset, or format, size, fit and quality. Advanced options stay folded away.<\/span><\/li>
      4. Download<\/strong>One file, or the whole batch as a ZIP built in the browser.<\/span><\/li><\/ol>\t\t\t\t<\/div>\n\t\t\t\t
        \n\t\t\t\t\t\t\t\t\t

        Nothing downloads automatically on paste. The preview comes first and the visitor decides.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t
        \"Paste
        The controls a person reaches for are visible; the rest is behind Advanced options.<\/figcaption><\/figure>\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
        \n\t\t\t\t\t
        \n\t\t\t\t
        \n\t\t\t\t\t

        Image Studio<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
        \n\t\t\t\t\t\t\t\t\t

        All of this runs on a canvas in the visitor’s browser. There is no upload, no queue and no server round trip.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t\t
        • Convert between PNG, JPEG, WebP and AVIF \u2014 and the encoder is probed at load, so a format the browser cannot actually write is disabled rather than silently producing something else.<\/li>
        • Resize with locked aspect ratio, and fit as contain, cover or stretch.<\/li>
        • Rotate, flip horizontally and vertically, reset.<\/li>
        • Quality control with a live before-and-after file size and a saved percentage.<\/li>
        • A background colour for transparent images flattened into JPEG, so alpha never becomes black.<\/li>
        • Presets for Instagram, Facebook, X, LinkedIn, YouTube, TikTok, WhatsApp and Open Graph.<\/li>
        • Batch up to 20 images, each keeping its own dimensions unless a size is chosen.<\/li>
        • ZIP export, assembled byte by byte in the browser with correct CRC32 and central directory.<\/li><\/ul>\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
          \n\t\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t\t

          Link tools, and honesty about them<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
          \n\t\t\t\t\t\t\t\t\t

          Eleven platforms are recognised. For each, the capability table lists what is genuinely available: metadata, thumbnail, official embed \u2014 and, in every case, no video or audio.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

          \n\t\t\t\t\t
          \"Paste
          A YouTube link. The limitation is stated where the reader is looking, not on another page.<\/figcaption><\/figure>\t\t\t\t<\/div>\n\t\t\t\t
          \n\t\t\t\t\t\t\t\t\t

          For YouTube the video id is parsed locally and the four published thumbnail sizes are probed directly against the official image host, so the list shows only sizes that really exist, with their real byte sizes. Choosing one requires an explicit, unchecked rights confirmation, and the thumbnail then opens in the Image Studio like any other image.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

          \n\t\t\t\t\t
          \"The
          The capability table is generated from the same source the code uses, so it cannot drift.<\/figcaption><\/figure>\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
          \n\t\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t\t

          Security: treating every URL as hostile<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
          \n\t\t\t\t\t\t\t\t\t

          The link service is the only part that talks to the internet, so it is the only part that can be turned against the server. The attack to defend is Server-Side Request Forgery: persuading this machine to fetch something only it can reach \u2014 localhost, the private network, or the cloud metadata endpoint that hands out credentials.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

          \n\t\t\t\t\t\t\t\t\t

          A hostname allowlist alone does not stop that. evil.com<\/code> can resolve to 169.254.169.254, and a name that resolves safely during validation can resolve elsewhere moments later when the HTTP client looks it up again \u2014 DNS rebinding. So the fetcher does three things a naive one does not:<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

          \n\t\t\t\t\t
          1. Allowlist by name<\/strong>Exact match or true subdomain, after normalising. An IP literal is never a valid host.<\/span><\/li>
          2. Resolve and judge every address<\/strong>Both A and AAAA records. Every one must be public unicast \u2014 one private answer rejects the host.<\/span><\/li>
          3. Pin the connection<\/strong>curl is given the exact address that was validated, so the name cannot resolve somewhere else between check and connect. Redirects are followed manually and re-validated from scratch.<\/span><\/li><\/ol>\t\t\t\t<\/div>\n\t\t\t\t
            \n\t\t\t\t\t
            • IPv4 private, loopback, link-local, CGNAT, benchmarking, multicast and reserved ranges are all rejected.<\/li>
            • IPv6 loopback, unique-local, link-local and multicast are rejected \u2014 and IPv4-mapped, IPv4-compatible and NAT64 forms are unwrapped and judged as the IPv4 address they really are.<\/li>
            • HTTPS only, standard port only, no credentials in the URL, at most three redirects.<\/li>
            • The protocol is restricted at the curl handle, so a redirect cannot hand it a file:\/\/ or gopher:\/\/ URL.<\/li>
            • Responses are capped mid-transfer, and the bytes are type-checked with libmagic rather than trusted from the Content-Type header.<\/li>
            • No shell is involved anywhere \u2014 there is no media tool to invoke and no command line to inject into.<\/li><\/ul>\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t

              What the tests actually try<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t

              The security claims above are assertions in a suite, not adjectives. Among the cases: the AWS and GCP metadata endpoints, localhost<\/code>, 127.0.0.1<\/code>, [::1]<\/code>, every private IPv4 range, IPv6 unique-local and link-local, IPv4-mapped IPv6 forms of private addresses, NAT64-wrapped loopback, file:\/\/<\/code>, gopher:\/\/<\/code>, a suffix-confusion host (youtube.com.attacker.example<\/code>), credentials embedded in the URL, a non-standard port, and a malformed video id.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

              \n\t\t\t\t\t
              Suite<\/th>Covers<\/th>Assertions<\/th><\/tr><\/thead>
              Unit<\/td>Address classification, host allowlist, URL validation, platform detection, YouTube id parsing, capability honesty, bilingual parity<\/td>139<\/td><\/tr>
              Live HTTP<\/td>Both language trees, metadata and assets, security headers, path exposure, link API, SSRF refusals, thumbnail relay, rate limiting, copy honesty<\/td>105<\/td><\/tr><\/tbody><\/table><\/div>\t\t\t\t<\/div>\n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t

              The image engine was verified in a real browser: a PNG with genuine alpha, conversion to JPEG and WebP at several qualities, a JPEG carrying a hand-built EXIF APP1 block \u2014 confirmed present on input and confirmed absent from the exported bytes \u2014 batch processing of differently sized files, and a ZIP whose entries were extracted and decoded back into images.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

              \n\t\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t

              Privacy that is structural, not promised<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t

              The privacy page does not say \u201cnothing is stored\u201d, because a web server keeps an access log and that would be untrue. What it says is narrower and verifiable: images never reach the server at all.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

              \n\t\t\t\t\t