Movatterモバイル変換


[0]ホーム

URL:


Alert GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder
Notice  The highest tagged major version isv2.

httpapi

package
v0.27.3Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Aug 1, 2023 License:AGPL-3.0Imports:26Imported by:0

Details

Repository

github.com/coder/coder

Links

Documentation

Index

Constants

View Source
const (// XForwardedHostHeader is a header used by proxies to indicate the// original host of the request.XForwardedHostHeader = "X-Forwarded-Host")

Variables

View Source
var ResourceNotFoundResponse =codersdk.Response{Message: "Resource not found or you do not have access to this resource"}
View Source
var (UsernameValidRegex =regexp.MustCompile("^[a-zA-Z0-9]+(?:-[a-zA-Z0-9]+)*$"))
View Source
var Validate *validator.Validate

Functions

funcCompileHostnamePatternadded inv0.10.0

func CompileHostnamePattern(patternstring) (*regexp.Regexp,error)

CompileHostnamePattern compiles a hostname pattern into a regular expression.A hostname pattern is a string that may contain a single wildcard characterat the beginning. The wildcard character matches any number of hostname-safecharacters excluding periods. The pattern is case-insensitive.

The supplied pattern:

  • must not start or end with a period
  • must contain exactly one asterisk at the beginning
  • must not contain any other wildcard characters
  • must not contain any other characters that are not hostname-safe (includingwhitespace)
  • must contain at least two hostname labels/segments (i.e. "foo" or "*" arenot valid patterns, but "foo.bar" and "*.bar" are).

The returned regular expression will match an entire hostname with optionaltrailing periods and whitespace. The first submatch will be the wildcardmatch.

funcExecuteHostnamePatternadded inv0.10.0

func ExecuteHostnamePattern(pattern *regexp.Regexp, hostnamestring) (string,bool)

ExecuteHostnamePattern executes a pattern generated by CompileHostnamePatternand returns the wildcard match. If the pattern does not match the hostname,returns false.

funcForbiddenadded inv0.5.10

func Forbidden(rwhttp.ResponseWriter)

funcHeartbeatadded inv0.9.3

func Heartbeat(ctxcontext.Context, conn *websocket.Conn)

Heartbeat loops to ping a WebSocket to keep it alive.Default idle connection timeouts are typically 60 seconds.See:https://docs.aws.amazon.com/elasticloadbalancing/latest/application/application-load-balancers.html#connection-idle-timeout

funcHeartbeatCloseadded inv0.26.2

func HeartbeatClose(ctxcontext.Context, exit func(), conn *websocket.Conn)

Heartbeat loops to ping a WebSocket to keep it alive. It kills the connectionon ping failure.

funcHostnamesMatchadded inv0.9.0

func HostnamesMatch(a, bstring)bool

HostnamesMatch returns true if the hostnames are equal, disregardingcapitalization, extra leading or trailing periods, and ports.

funcInternalServerErroradded inv0.8.10

func InternalServerError(rwhttp.ResponseWriter, errerror)

funcIs404Erroradded inv0.22.1

func Is404Error(errerror)bool

Is404Error returns true if the given error should return a 404 status code.Both actual 404s and unauthorized errors should return 404s to not leakinformation about the existence of resources.

funcIsWebsocketUpgradeadded inv0.8.10

func IsWebsocketUpgrade(r *http.Request)bool

funcNameValidadded inv0.12.6

func NameValid(strstring)error

NameValid returns whether the input string is a valid name.It is a generic validator for any name (user, workspace, template, etc.).

funcParseCustomadded inv0.7.5

func ParseCustom[Tany](parser *QueryParamParser, valsurl.Values, def T, queryParamstring, parseFunc func(vstring) (T,error)) T

ParseCustom has to be a function, not a method on QueryParamParser because genericscannot be used on struct methods.

funcParseCustomListadded inv0.18.1

func ParseCustomList[Tany](parser *QueryParamParser, valsurl.Values, def []T, queryParamstring, parseFunc func(vstring) (T,error)) []T

ParseCustomList is a function that handles csv query params.

funcParseEnumadded inv0.18.1

func ParseEnum[TValidEnum](termstring) (T,error)

ParseEnum is a function that can be passed into ParseCustom that handles enumvalidation.

funcRead

func Read(ctxcontext.Context, rwhttp.ResponseWriter, r *http.Request, value interface{})bool

Read decodes JSON from the HTTP request into the value provided. It usesgo-validator to validate the incoming request body. ctx is used for tracingand can be nil. Although tracing this function isn't likely too helpful, itwas done to be consistent with Write.

funcRequestHostadded inv0.8.10

func RequestHost(r *http.Request)string

RequestHost returns the name of the host from the request. It prioritizes'X-Forwarded-Host' over r.Host since most requests are being proxied.

funcResourceNotFoundadded inv0.7.0

func ResourceNotFound(rwhttp.ResponseWriter)

ResourceNotFound is intentionally vague. All 404 responses should be identicalto prevent leaking existence of resources.

funcRouteNotFoundadded inv0.9.0

func RouteNotFound(rwhttp.ResponseWriter)

funcServerSentEventSenderadded inv0.9.0

func ServerSentEventSender(rwhttp.ResponseWriter, r *http.Request) (sendEvent func(ctxcontext.Context, ssecodersdk.ServerSentEvent)error, closed chan struct{}, errerror)

funcStripCoderCookiesadded inv0.8.6

func StripCoderCookies(headerstring)string

StripCoderCookies removes the session token from the cookie header provided.

funcTemplateDisplayNameValidadded inv0.12.6

func TemplateDisplayNameValid(strstring)error

TemplateDisplayNameValid returns whether the input string is a valid template display name.

funcTemplateVersionNameValidadded inv0.21.3

func TemplateVersionNameValid(strstring)error

TemplateVersionNameValid returns whether the input string is a valid template version name.

funcUsernameFromadded inv0.8.2

func UsernameFrom(strstring)string

UsernameFrom returns a best-effort username from the provided string.

It first attempts to validate the incoming string, which willbe returned if it is valid. It then will attempt to extractthe username from an email address. If no success happens duringthese steps, a random username will be returned.

funcWebsocketCloseSprintf

func WebsocketCloseSprintf(formatstring, vars ...any)string

WebsocketCloseSprintf formats a websocket close message and ensures it istruncated to the maximum allowed length.

funcWrite

func Write(ctxcontext.Context, rwhttp.ResponseWriter, statusint, response interface{})

Write outputs a standardized format to an HTTP response body. ctx is used fortracing and can be nil for tracing to be disabled. Tracing this function ishelpful because JSON marshaling can sometimes take a non-insignificant amountof time, and could help us catch outliers. Additionally, we can enrich spandata a bit more since we have access to the actual interface{} we'remarshaling, such as the number of elements in an array, which could help usspot routes that need to be paginated.

funcWriteIndentadded inv0.24.0

func WriteIndent(ctxcontext.Context, rwhttp.ResponseWriter, statusint, response interface{})

Types

typeApplicationURLadded inv0.8.15

type ApplicationURL struct {AppSlugOrPortstringAgentNamestringWorkspaceNamestringUsernamestring}

ApplicationURL is a parsed application URL hostname.

funcParseSubdomainAppURLadded inv0.8.15

func ParseSubdomainAppURL(subdomainstring) (ApplicationURL,error)

ParseSubdomainAppURL parses an ApplicationURL from the given subdomain. Ifthe subdomain is not a valid application URL hostname, returns a non-nilerror. If the hostname is not a subdomain of the given base hostname, returnsa non-nil error.

The base hostname should not include a scheme, leading asterisk or dot.

Subdomains should be in the form:

{PORT/APP_SLUG}--{AGENT_NAME}--{WORKSPACE_NAME}--{USERNAME}(eg. https://8080--main--dev--dean.hi.c8s.io)

func (ApplicationURL)Stringadded inv0.8.15

func (aApplicationURL) String()string

String returns the application URL hostname without scheme. You will likelywant to append a period and the base hostname.

typeDurationadded inv0.12.2

type Durationtime.Duration

Duration wraps time.Duration and provides better JSON marshaling andunmarshalling. The default time.Duration marshals as an integer and onlyaccepts integers when unmarshalling, which is not very user friendly as userscannot write durations like "1h30m".

This type marshals as a string like "1h30m", and unmarshals from either astring or an integer.

func (Duration)MarshalJSONadded inv0.12.2

func (dDuration) MarshalJSON() ([]byte,error)

MarshalJSON implements json.Marshaler.

func (*Duration)UnmarshalJSONadded inv0.12.2

func (d *Duration) UnmarshalJSON(b []byte)error

UnmarshalJSON implements json.Unmarshaler.

typeQueryParamParseradded inv0.7.0

type QueryParamParser struct {// Errors is the set of errors to return via the API. If the length// of this set is 0, there are no errors!.Errors []codersdk.ValidationError// Parsed is a map of all query params that were parsed. This is useful// for checking if extra query params were passed in.Parsed map[string]bool// RequiredParams is a map of all query params that are required. This is useful// for forcing a value to be provided.RequiredParams map[string]bool}

QueryParamParser is a helper for parsing all query params and gathering allerrors in 1 sweep. This means all invalid fields are returned at once,rather than only returning the first error

funcNewQueryParamParseradded inv0.7.0

func NewQueryParamParser() *QueryParamParser

func (*QueryParamParser)ErrorExcessParamsadded inv0.18.1

func (p *QueryParamParser) ErrorExcessParams(valuesurl.Values)

ErrorExcessParams checks if any query params were passed in that were notparsed. If so, it adds an error to the parser as these values are not validquery parameters.

func (*QueryParamParser)Intadded inv0.7.0

func (p *QueryParamParser) Int(valsurl.Values, defint, queryParamstring)int

func (*QueryParamParser)Requiredadded inv0.22.0

func (p *QueryParamParser) Required(queryParamstring) *QueryParamParser

func (*QueryParamParser)Stringadded inv0.7.0

func (p *QueryParamParser) String(valsurl.Values, defstring, queryParamstring)string

func (*QueryParamParser)Stringsadded inv0.7.5

func (p *QueryParamParser) Strings(valsurl.Values, def []string, queryParamstring) []string

func (*QueryParamParser)Timeadded inv0.18.1

func (p *QueryParamParser) Time(valsurl.Values, deftime.Time, queryParam, layoutstring)time.Time

func (*QueryParamParser)Time3339Nanoadded inv0.25.0

func (p *QueryParamParser) Time3339Nano(valsurl.Values, deftime.Time, queryParamstring)time.Time

Time uses the default time format of RFC3339Nano and always returns a UTC time.

func (*QueryParamParser)UIntadded inv0.22.0

func (p *QueryParamParser) UInt(valsurl.Values, defuint64, queryParamstring)uint64

func (*QueryParamParser)UUIDadded inv0.7.0

func (p *QueryParamParser) UUID(valsurl.Values, defuuid.UUID, queryParamstring)uuid.UUID

func (*QueryParamParser)UUIDorMeadded inv0.7.0

func (p *QueryParamParser) UUIDorMe(valsurl.Values, defuuid.UUID, meuuid.UUID, queryParamstring)uuid.UUID

func (*QueryParamParser)UUIDsadded inv0.7.0

func (p *QueryParamParser) UUIDs(valsurl.Values, def []uuid.UUID, queryParamstring) []uuid.UUID

typeValidEnumadded inv0.18.1

type ValidEnum interface {database.ResourceType |database.AuditAction |database.BuildReason |database.UserStatus |database.WorkspaceStatus// Valid is required on the enum type to be used with ParseEnum.Valid()bool}

ValidEnum parses enum query params. Add more to the list as needed.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f orF : Jump to
y orY : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic.Learn more.

[8]ページ先頭

©2009-2025 Movatter.jp