Movatterモバイル変換


[0]ホーム

URL:


Alert GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder
Notice  The highest tagged major version isv2.

gitauth

package
v0.27.3Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Aug 1, 2023 License:AGPL-3.0Imports:21Imported by:0

Details

Repository

github.com/coder/coder

Links

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

funcCheckCommand

func CheckCommand(args, env []string)bool

CheckCommand returns true if the command arguments and environmentmatch those when the GIT_ASKPASS command is invoked by git.

funcOverrideVSCodeConfigs

func OverrideVSCodeConfigs(fsafero.Fs)error

OverrideVSCodeConfigs overwrites a few properties to consumeGIT_ASKPASS from the host instead of VS Code-specific authentication.

funcParseAskpass

func ParseAskpass(promptstring) (userstring, hoststring, errerror)

ParseAskpass returns the user and host from a git askpass prompt. Forexample: "user1" and "https://github.com". Note that for HTTPprotocols, the URL will never contain a path.

For details on how the prompt is formatted, see `credential_ask_one`:https://github.com/git/git/blob/bbe21b64a08f89475d8a3818e20c111378daa621/credential.c#L173-L191

Types

typeAppInstallationadded inv0.25.0

type AppInstallation struct {IDint// Login is the username of the installation.Loginstring// URL is a link to configure the app install.URLstring}

typeConfig

type Config struct {OAuth2Config// ID is a unique identifier for the authenticator.IDstring// Regex is a regexp that URLs will match against.Regex *regexp.Regexp// Type is the type of provider.Typecodersdk.GitProvider// NoRefresh stops Coder from using the refresh token// to renew the access token.//// Some organizations have security policies that require// re-authentication for every token.NoRefreshbool// ValidateURL ensures an access token is valid before// returning it to the user. If omitted, tokens will// not be validated before being returned.ValidateURLstring// AppInstallURL is for GitHub App's (and hopefully others eventually)// to provide a link to install the app. There's installation// of the application, and user authentication. It's possible// for the user to authenticate but the application to not.AppInstallURLstring// InstallationsURL is an API endpoint that returns a list of// installations for the user. This is used for GitHub Apps.AppInstallationsURLstring// DeviceAuth is set if the provider uses the device flow.DeviceAuth *DeviceAuth}

Config is used for authentication for Git operations.

funcConvertConfig

func ConvertConfig(entries []codersdk.GitAuthConfig, accessURL *url.URL) ([]*Config,error)

ConvertConfig converts the SDK configuration entry formatto the parsed and ready-to-consume in coderd provider type.

func (*Config)AppInstallationsadded inv0.25.0

func (c *Config) AppInstallations(ctxcontext.Context, tokenstring) ([]codersdk.GitAuthAppInstallation,bool,error)

AppInstallations returns a list of app installations for the given token.If the provider does not support app installations, it returns nil.

func (*Config)RefreshTokenadded inv0.20.1

func (c *Config) RefreshToken(ctxcontext.Context, dbdatabase.Store, gitAuthLinkdatabase.GitAuthLink) (database.GitAuthLink,bool,error)

RefreshToken automatically refreshes the token if expired and permitted.It returns the token and a bool indicating if the token was refreshed.

func (*Config)ValidateTokenadded inv0.20.1

func (c *Config) ValidateToken(ctxcontext.Context, tokenstring) (bool, *codersdk.GitAuthUser,error)

ValidateToken ensures the Git token provided is valid!The user is optionally returned if the provider supports it.

typeDeviceAuthadded inv0.25.0

type DeviceAuth struct {ClientIDstringTokenURLstringScopes   []stringCodeURLstring}

func (*DeviceAuth)AuthorizeDeviceadded inv0.25.0

func (c *DeviceAuth) AuthorizeDevice(ctxcontext.Context) (*codersdk.GitAuthDevice,error)

AuthorizeDevice begins the device authorization flow.See:https://tools.ietf.org/html/rfc8628#section-3.1

func (*DeviceAuth)ExchangeDeviceCodeadded inv0.25.0

func (c *DeviceAuth) ExchangeDeviceCode(ctxcontext.Context, deviceCodestring) (*oauth2.Token,error)

ExchangeDeviceCode exchanges a device code for an access token.The boolean returned indicates whether the device code is still pendingand the caller should try again.

typeExchangeDeviceCodeResponseadded inv0.25.0

type ExchangeDeviceCodeResponse struct {AccessTokenstring `json:"access_token"`RefreshTokenstring `json:"refresh_token"`ExpiresInint    `json:"expires_in"`Errorstring `json:"error"`ErrorDescriptionstring `json:"error_description"`}

typeOAuth2Configadded inv0.25.0

type OAuth2Config interface {AuthCodeURL(statestring, opts ...oauth2.AuthCodeOption)stringExchange(ctxcontext.Context, codestring, opts ...oauth2.AuthCodeOption) (*oauth2.Token,error)TokenSource(context.Context, *oauth2.Token)oauth2.TokenSource}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f orF : Jump to
y orY : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic.Learn more.

[8]ページ先頭

©2009-2025 Movatter.jp