Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 37332e6

Browse files
github-actions[bot]zedkipp
github-actions[bot]
and
zedkipp
authored
fix: prevent session token exfiltration via external app URLs (#26146) (#26303)
Backport of #26146 Original PR: #26146 — fix: prevent session token exfiltration via external app URLs Merge commit: 9b550cb Requested by: @f0ssel Co-authored-by: Zach <[email protected]>
1 parent fa933af commit 37332e6

3 files changed

Lines changed: 121 additions & 37 deletions

File tree

‎cli/open.go‎

Lines changed: 24 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,11 @@ func (r *RootCmd) open() *serpent.Command {
3939

4040
const vscodeDesktopName = "VS Code Desktop"
4141

42+
// externalSessionTokenPlaceholder is the literal substring in an external
43+
// workspace-app URL that the CLI replaces with the user's session token
44+
// when the app belongs to a trusted (top-level) agent.
45+
const externalSessionTokenPlaceholder = "$SESSION_TOKEN"
46+
4247
func (r *RootCmd) openVSCode() *serpent.Command {
4348
var (
4449
generateToken bool
@@ -387,8 +392,13 @@ func (r *RootCmd) openApp() *serpent.Command {
387392
pathAppURL := strings.TrimPrefix(region.PathAppURL, baseURL.String())
388393
appURL := buildAppLinkURL(baseURL, ws, agt, foundApp, region.WildcardHostname, pathAppURL)
389394

390-
if foundApp.External {
391-
appURL = replacePlaceholderExternalSessionTokenString(client, appURL)
395+
externalSubAgentApp := foundApp.External && agt.ParentID.Valid
396+
if foundApp.External && !agt.ParentID.Valid {
397+
// Template-defined apps run on a top-level agent and are
398+
// admin-authored, so their URLs are trusted. Substitute the
399+
// session token placeholder so the OS open handler receives
400+
// a usable URL.
401+
appURL = strings.ReplaceAll(appURL, externalSessionTokenPlaceholder, client.SessionToken())
392402
}
393403

394404
// Check if we're inside a workspace. Generally, we know
@@ -399,6 +409,18 @@ func (r *RootCmd) openApp() *serpent.Command {
399409
_, _ = fmt.Fprintf(inv.Stdout, "%s\n", appURL)
400410
return nil
401411
}
412+
413+
// Sub-agent external app URLs are set at runtime. Only open
414+
// sub-agent URLs that don't contain the placeholder to prevent
415+
// token exfiltration.
416+
if externalSubAgentApp && strings.Contains(appURL, externalSessionTokenPlaceholder) {
417+
cliui.Warnf(inv.Stderr,
418+
"This app was registered from inside the workspace rather than from the workspace template. "+
419+
"Inspect the URL below carefully and, if you trust the source, substitute the $SESSION_TOKEN placeholder "+
420+
"with your session token and manually open it:")
421+
_, _ = fmt.Fprintf(inv.Stdout, "%s\n", appURL)
422+
return nil
423+
}
402424
_, _ = fmt.Fprintf(inv.Stderr, "Opening %s\n", appURL)
403425

404426
if !testOpenError {
@@ -668,15 +690,3 @@ func buildAppLinkURL(baseURL *url.URL, workspace codersdk.Workspace, agent coder
668690
}
669691
return u.String()
670692
}
671-
672-
// replacePlaceholderExternalSessionTokenString replaces any $SESSION_TOKEN
673-
// strings in the URL with the actual session token.
674-
// This is consistent behavior with the frontend. See: site/src/modules/resources/AppLink/AppLink.tsx
675-
func replacePlaceholderExternalSessionTokenString(client *codersdk.Client, appURL string) string {
676-
if !strings.Contains(appURL, "$SESSION_TOKEN") {
677-
return appURL
678-
}
679-
680-
// We will just re-use the existing session token we're already using.
681-
return strings.ReplaceAll(appURL, "$SESSION_TOKEN", client.SessionToken())
682-
}

‎cli/open_test.go‎

Lines changed: 97 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
11
package cli_test
22

33
import (
4+
"bytes"
45
"context"
6+
"database/sql"
57
"net/url"
68
"os"
79
"path"
@@ -21,6 +23,9 @@ import (
2123
"github.com/coder/coder/v2/agent/agenttest"
2224
"github.com/coder/coder/v2/cli/clitest"
2325
"github.com/coder/coder/v2/coderd/coderdtest"
26+
"github.com/coder/coder/v2/coderd/database"
27+
"github.com/coder/coder/v2/coderd/database/dbfake"
28+
"github.com/coder/coder/v2/coderd/database/dbgen"
2429
"github.com/coder/coder/v2/coderd/database/dbtime"
2530
"github.com/coder/coder/v2/codersdk"
2631
"github.com/coder/coder/v2/provisionersdk/proto"
@@ -654,14 +659,16 @@ func TestOpenApp(t *testing.T) {
654659
w.RequireContains("region not found")
655660
})
656661

657-
t.Run("ExternalAppSessionToken", func(t *testing.T) {
662+
t.Run("ExternalAppOnTopLevelAgentSubstitutes", func(t *testing.T) {
658663
t.Parallel()
659664

665+
// Apps on the top-level (template-defined) agent are trusted, so the
666+
// CLI substitutes $SESSION_TOKEN regardless of scheme.
660667
client, ws, _ := setupWorkspaceForAgent(t, func(agents []*proto.Agent) []*proto.Agent {
661668
agents[0].Apps = []*proto.App{
662669
{
663670
Slug: "app1",
664-
Url: "https://example.com/app1?token=$SESSION_TOKEN",
671+
Url: "vscode://coder.coder-remote/open?token=$SESSION_TOKEN",
665672
External: true,
666673
},
667674
}
@@ -678,4 +685,92 @@ func TestOpenApp(t *testing.T) {
678685
w.RequireContains("test.open-error")
679686
w.RequireContains(client.SessionToken())
680687
})
688+
689+
t.Run("ExternalAppOnSubAgentWithPlaceholderPrintsURLAndDoesNotOpen", func(t *testing.T) {
690+
t.Parallel()
691+
692+
// Sub-agent app URLs are attacker-influenceable through workspace
693+
// configuration and runtime registration. The CLI must not
694+
// substitute the session token, and must not hand the URL to the
695+
// OS open handler. The URL is printed to stdout so a user who
696+
// trusts the source can substitute and open it manually.
697+
ownerClient, store := coderdtest.NewWithDatabase(t, nil)
698+
ownerClient.SetLogger(testutil.Logger(t).Named("client"))
699+
first := coderdtest.CreateFirstUser(t, ownerClient)
700+
userClient, user := coderdtest.CreateAnotherUserMutators(t, ownerClient, first.OrganizationID, nil, func(r *codersdk.CreateUserRequestWithOrgs) {
701+
r.Username = "subagentowner"
702+
})
703+
r := dbfake.WorkspaceBuild(t, store, database.WorkspaceTable{
704+
Name: "subagentws",
705+
OrganizationID: first.OrganizationID,
706+
OwnerID: user.ID,
707+
}).WithAgent().Do()
708+
709+
require.NotEmpty(t, r.Agents, "expected at least one workspace agent")
710+
mainAgent := r.Agents[0]
711+
712+
subAgent := dbgen.WorkspaceSubAgent(t, store, mainAgent, database.WorkspaceAgent{
713+
Name: "devcontainer",
714+
})
715+
_ = dbgen.WorkspaceApp(t, store, database.WorkspaceApp{
716+
AgentID: subAgent.ID,
717+
Slug: "subapp",
718+
External: true,
719+
Url: sql.NullString{Valid: true, String: "vscode://coder.coder-remote/open?token=$SESSION_TOKEN"},
720+
})
721+
722+
inv, root := clitest.New(t, "open", "app", r.Workspace.Name+".devcontainer", "subapp", "--test.open-error")
723+
clitest.SetupConfig(t, userClient, root)
724+
var stdout, stderr bytes.Buffer
725+
inv.Stdout = &stdout
726+
inv.Stderr = &stderr
727+
728+
w := clitest.StartWithWaiter(t, inv)
729+
w.RequireSuccess()
730+
require.NotContains(t, stderr.String(), "test.open-error")
731+
require.NotContains(t, stdout.String(), "test.open-error")
732+
require.Contains(t, stdout.String(), "vscode://coder.coder-remote/open?token=$SESSION_TOKEN")
733+
require.NotContains(t, stdout.String(), userClient.SessionToken())
734+
require.Contains(t, stderr.String(), "substitute")
735+
})
736+
737+
t.Run("ExternalAppOnSubAgentWithoutPlaceholderOpensAsIs", func(t *testing.T) {
738+
t.Parallel()
739+
740+
// Sub-agent app URLs that don't reference $SESSION_TOKEN carry no
741+
// token to leak. The CLI auto-opens them like any other external
742+
// app; only placeholder-bearing URLs are gated.
743+
ownerClient, store := coderdtest.NewWithDatabase(t, nil)
744+
ownerClient.SetLogger(testutil.Logger(t).Named("client"))
745+
first := coderdtest.CreateFirstUser(t, ownerClient)
746+
userClient, user := coderdtest.CreateAnotherUserMutators(t, ownerClient, first.OrganizationID, nil, func(r *codersdk.CreateUserRequestWithOrgs) {
747+
r.Username = "subagentowner2"
748+
})
749+
r := dbfake.WorkspaceBuild(t, store, database.WorkspaceTable{
750+
Name: "subagentws2",
751+
OrganizationID: first.OrganizationID,
752+
OwnerID: user.ID,
753+
}).WithAgent().Do()
754+
755+
require.NotEmpty(t, r.Agents, "expected at least one workspace agent")
756+
mainAgent := r.Agents[0]
757+
758+
subAgent := dbgen.WorkspaceSubAgent(t, store, mainAgent, database.WorkspaceAgent{
759+
Name: "devcontainer",
760+
})
761+
_ = dbgen.WorkspaceApp(t, store, database.WorkspaceApp{
762+
AgentID: subAgent.ID,
763+
Slug: "subapp",
764+
External: true,
765+
Url: sql.NullString{Valid: true, String: "https://example.com/some/path"},
766+
})
767+
768+
inv, root := clitest.New(t, "open", "app", r.Workspace.Name+".devcontainer", "subapp", "--test.open-error")
769+
clitest.SetupConfig(t, userClient, root)
770+
771+
w := clitest.StartWithWaiter(t, inv)
772+
w.RequireError()
773+
w.RequireContains("test.open-error")
774+
w.RequireContains("https://example.com/some/path")
775+
})
681776
}

‎docs/user-guides/devcontainers/customizing-dev-containers.md‎

Lines changed: 0 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -247,27 +247,6 @@ Standard dev container variables are also available:
247247
| `${containerWorkspaceFolder}` | Workspace folder path inside the container |
248248
| `${localWorkspaceFolder}` | Workspace folder path on the host |
249249

250-
### Session token
251-
252-
Use `$SESSION_TOKEN` in external app URLs to include the user's session token:
253-
254-
```json
255-
{
256-
"customizations": {
257-
"coder": {
258-
"apps": [
259-
{
260-
"slug": "custom-ide",
261-
"displayName": "Custom IDE",
262-
"url": "custom-ide://open?token=$SESSION_TOKEN&folder=${containerWorkspaceFolder}",
263-
"external": true
264-
}
265-
]
266-
}
267-
}
268-
}
269-
```
270-
271250
## Feature options as environment variables
272251

273252
When your dev container uses features, Coder exposes feature options as

0 commit comments

Comments
 (0)