GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder
The highest tagged major version isv2.
gorules
packageThis package is not in the latest version of its module.
Details
Validgo.mod file
The Go module system was introduced in Go 1.11 and is the official dependency management solution for Go.
- Redistributable license
Redistributable licenses place minimal restrictions on how software can be used, modified, and redistributed.
- Tagged version
Modules with tagged versions give importers more predictable builds.
Stable versionWhen a project reaches major version v1 it is considered stable.
- Learn more about best practices
Repository
Links
Open Source Insights
Documentation¶
Overview¶
Package gorules defines custom lint rules for ruleguard.
golangci-lint runs these rules via go-critic, which includes supportfor ruleguard. All Go files in this directory define lint rulesin the Ruleguard DSL; see:
-https://go-ruleguard.github.io/by-example/-https://pkg.go.dev/github.com/quasilyte/go-ruleguard/dsl
You run one of the following commands to execute your go rules only:
golangci-lint rungolangci-lint run --disable-all --enable=gocritic
Note: don't forget to run `golangci-lint cache clean`!
Index¶
Constants¶
This section is empty.
Variables¶
This section is empty.
Functions¶
funcFullResponseWriter¶added inv0.9.1
FullResponseWriter ensures that any overridden response writer has fullfunctionality. Mainly is hijackable and flushable.
funcHttpAPIErrorMessage¶added inv0.6.3
HttpAPIErrorMessage intends to enforce constructing proper sentences aserror messages for the api. A proper sentence includes proper capitalizationand ends with punctuation.There are ways around the linter, but this should work in the common cases.
funcHttpAPIReturn¶added inv0.7.7
HttpAPIReturn will report a linter violation if the http function is notreturned after writing a response to the client.
funcInTx¶
InTx checks to ensure the database used inside the transaction closure is the transactiondatabase, and not the original database that creates the tx.
funcProperRBACReturn¶added inv0.7.0
ProperRBACReturn ensures we always write to the response writer after acall to Authorize. If we just do a return, the client will get a status code200, which is incorrect.
Types¶
This section is empty.
Source Files
Directories