diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index d7ef868576f9a..f45537c9e41b6 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -553,6 +553,18 @@ jobs:
gcloud storage cp "./build/${detached_signature}" "gs://releases.coder.com/coder-cli/${version}/${cli_name}.asc"
done
+ # Mint a short-lived installation token from the dedicated release
+ # GitHub App. The default GITHUB_TOKEN (github-actions[bot]) cannot be
+ # added to the "Auto-imported tag create protections" ruleset bypass
+ # list, so `gh release create` fails to create the tag with a 403. The
+ # App is added to that ruleset's bypass list as an Integration actor.
+ - name: Generate release App token
+ id: release_app_token
+ uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+ with:
+ app-id: ${{ secrets.RELEASE_APP_ID }}
+ private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+
- name: Publish release
run: |
set -euo pipefail
@@ -591,7 +603,9 @@ jobs:
--release-notes-file "$CODER_RELEASE_NOTES_FILE" \
"${files[@]}"
env:
- GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ # Use the dedicated release App token (github-actions[bot] is blocked
+ # from creating tags by the tag-create protection ruleset).
+ GITHUB_TOKEN: ${{ steps.release_app_token.outputs.token }}
CODER_GPG_RELEASE_KEY_BASE64: ${{ secrets.GPG_RELEASE_KEY_BASE64 }}
VERSION: ${{ steps.version.outputs.version }}
CREATED_LATEST_TAG: ${{ steps.build_docker.outputs.created_latest_tag }}
diff --git a/aibridge/bridge.go b/aibridge/bridge.go
index e7b9101a2d7e2..f736dd6c422eb 100644
--- a/aibridge/bridge.go
+++ b/aibridge/bridge.go
@@ -16,6 +16,7 @@ import (
"github.com/sony/gobreaker/v2"
"go.opentelemetry.io/otel/codes"
"go.opentelemetry.io/otel/trace"
+ "golang.org/x/net/http/httpguts"
"golang.org/x/xerrors"
"cdr.dev/slog/v3"
@@ -227,6 +228,18 @@ func newInterceptionProcessor(p provider.Provider, cbs *circuitbreaker.ProviderC
client := GuessClient(r)
sessionID := GuessSessionID(client, r)
+ if isWebSocketUpgrade(r) {
+ route := strings.TrimPrefix(r.URL.Path, fmt.Sprintf("/%s", p.Name()))
+ logger.Debug(ctx, "rejecting unsupported WebSocket upgrade",
+ slog.F("provider", p.Name()),
+ slog.F("route", route),
+ slog.F("client", string(client)),
+ slog.F("client_session_id", sessionID),
+ )
+ http.Error(w, "WebSocket transport is not supported, use HTTP", http.StatusNotImplemented)
+ return
+ }
+
interceptor, err := p.CreateInterceptor(w, r.WithContext(ctx), tracer)
if err != nil {
span.SetStatus(codes.Error, fmt.Sprintf("failed to create interceptor: %v", err))
@@ -346,6 +359,13 @@ func newInterceptionProcessor(p provider.Provider, cbs *circuitbreaker.ProviderC
}
}
+// isWebSocketUpgrade reports whether r is a WebSocket opening handshake.
+func isWebSocketUpgrade(r *http.Request) bool {
+ return r.Method == http.MethodGet &&
+ httpguts.HeaderValuesContainsToken(r.Header.Values("Connection"), "upgrade") &&
+ httpguts.HeaderValuesContainsToken(r.Header.Values("Upgrade"), "websocket")
+}
+
// writeRequestBodyTooLarge writes a human-readable 413 response indicating that
// the request body exceeded maxRequestBodyBytes.
func writeRequestBodyTooLarge(w http.ResponseWriter) {
diff --git a/aibridge/bridge_internal_test.go b/aibridge/bridge_internal_test.go
new file mode 100644
index 0000000000000..0b07ed98c3a2f
--- /dev/null
+++ b/aibridge/bridge_internal_test.go
@@ -0,0 +1,39 @@
+package aibridge
+
+import (
+ "net/http"
+ "testing"
+
+ "github.com/stretchr/testify/assert"
+ "github.com/stretchr/testify/require"
+)
+
+func TestIsWebSocketUpgrade(t *testing.T) {
+ t.Parallel()
+
+ tests := []struct {
+ name string
+ method string
+ connection string
+ upgrade string
+ want bool
+ }{
+ {name: "websocket upgrade", method: http.MethodGet, connection: "keep-alive, Upgrade", upgrade: "WebSocket", want: true},
+ {name: "non-GET request", method: http.MethodPost, connection: "Upgrade", upgrade: "websocket", want: false},
+ {name: "missing connection upgrade", method: http.MethodGet, connection: "keep-alive", upgrade: "websocket", want: false},
+ {name: "different upgrade protocol", method: http.MethodGet, connection: "Upgrade", upgrade: "h2c", want: false},
+ }
+
+ for _, tc := range tests {
+ t.Run(tc.name, func(t *testing.T) {
+ t.Parallel()
+
+ req, err := http.NewRequestWithContext(t.Context(), tc.method, "/", nil)
+ require.NoError(t, err)
+ req.Header.Set("Connection", tc.connection)
+ req.Header.Set("Upgrade", tc.upgrade)
+
+ assert.Equal(t, tc.want, isWebSocketUpgrade(req))
+ })
+ }
+}
diff --git a/aibridge/bridge_test.go b/aibridge/bridge_test.go
index 9ac7ea9ec3ddb..c8057b02ff305 100644
--- a/aibridge/bridge_test.go
+++ b/aibridge/bridge_test.go
@@ -12,10 +12,12 @@ import (
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"go.opentelemetry.io/otel"
+ "go.opentelemetry.io/otel/trace"
"cdr.dev/slog/v3/sloggers/slogtest"
"github.com/coder/coder/v2/aibridge"
"github.com/coder/coder/v2/aibridge/config"
+ "github.com/coder/coder/v2/aibridge/intercept"
"github.com/coder/coder/v2/aibridge/internal/testutil"
"github.com/coder/coder/v2/aibridge/provider"
)
@@ -123,11 +125,12 @@ func TestPassthroughRoutesForProviders(t *testing.T) {
upstreamRespBody := "upstream response"
tests := []struct {
- name string
- baseURLPath string
- requestPath string
- provider func(string) provider.Provider
- expectPath string
+ name string
+ baseURLPath string
+ requestMethod string
+ requestPath string
+ provider func(string) provider.Provider
+ expectPath string
}{
{
name: "openAI_no_base_path",
@@ -180,6 +183,23 @@ func TestPassthroughRoutesForProviders(t *testing.T) {
},
expectPath: "/v1/models",
},
+ {
+ name: "copilot_ping",
+ requestPath: "/copilot/_ping",
+ provider: func(baseURL string) provider.Provider {
+ return aibridge.NewCopilotProvider(config.Copilot{BaseURL: baseURL})
+ },
+ expectPath: "/_ping",
+ },
+ {
+ name: "copilot_auto",
+ requestMethod: http.MethodPost,
+ requestPath: "/copilot/auto",
+ provider: func(baseURL string) provider.Provider {
+ return aibridge.NewCopilotProvider(config.Copilot{BaseURL: baseURL})
+ },
+ expectPath: "/auto",
+ },
}
for _, tc := range tests {
@@ -200,7 +220,7 @@ func TestPassthroughRoutesForProviders(t *testing.T) {
bridge, err := aibridge.NewRequestBridge(t.Context(), []provider.Provider{prov}, &rec, nil, logger, nil, bridgeTestTracer)
require.NoError(t, err)
- req := httptest.NewRequest("", tc.requestPath, nil)
+ req := httptest.NewRequest(tc.requestMethod, tc.requestPath, nil)
resp := httptest.NewRecorder()
bridge.ServeHTTP(resp, req)
@@ -210,6 +230,37 @@ func TestPassthroughRoutesForProviders(t *testing.T) {
}
}
+func TestWebSocketUpgradeRejected(t *testing.T) {
+ t.Parallel()
+
+ interceptorCalled := false
+ prov := &testutil.MockProvider{
+ NameStr: "test",
+ Bridged: []string{"/responses"},
+ InterceptorFunc: func(http.ResponseWriter, *http.Request, trace.Tracer) (intercept.Interceptor, error) {
+ interceptorCalled = true
+ return nil, nil //nolint:nilnil // The interceptor must not be reached.
+ },
+ }
+ bridge, err := aibridge.NewRequestBridge(
+ t.Context(),
+ []provider.Provider{prov},
+ nil, nil, slogtest.Make(t, nil), nil, bridgeTestTracer,
+ )
+ require.NoError(t, err)
+
+ req := httptest.NewRequest(http.MethodGet, "/test/responses", nil)
+ req.Header.Set("Connection", "keep-alive, Upgrade")
+ req.Header.Set("Upgrade", "WebSocket")
+ resp := httptest.NewRecorder()
+
+ bridge.ServeHTTP(resp, req)
+
+ assert.Equal(t, http.StatusNotImplemented, resp.Code)
+ assert.Contains(t, resp.Body.String(), "WebSocket transport is not supported, use HTTP")
+ assert.False(t, interceptorCalled)
+}
+
func TestRequestBodySizeLimit(t *testing.T) {
t.Parallel()
diff --git a/aibridge/provider/copilot.go b/aibridge/provider/copilot.go
index fd317aadabac9..7859342e81e68 100644
--- a/aibridge/provider/copilot.go
+++ b/aibridge/provider/copilot.go
@@ -97,6 +97,8 @@ func (*Copilot) BridgedRoutes() []string {
func (*Copilot) PassthroughRoutes() []string {
return []string{
+ "/_ping",
+ "/auto",
"/models",
"/models/",
"/agents/",
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
index eb1a1a634ceaa..f338ba7db94e2 100644
--- a/coderd/database/dbauthz/dbauthz.go
+++ b/coderd/database/dbauthz/dbauthz.go
@@ -1959,6 +1959,13 @@ func (q *querier) DeleteApplicationConnectAPIKeysByUserID(ctx context.Context, u
return q.db.DeleteApplicationConnectAPIKeysByUserID(ctx, userID)
}
+func (q *querier) DeleteCachedModuleFilesCreatedBetween(ctx context.Context, arg database.DeleteCachedModuleFilesCreatedBetweenParams) (int64, error) {
+ if err := q.authorizeContext(ctx, policy.ActionDelete, rbac.ResourceSystem); err != nil {
+ return 0, err
+ }
+ return q.db.DeleteCachedModuleFilesCreatedBetween(ctx, arg)
+}
+
func (q *querier) DeleteChatDebugDataAfterMessageID(ctx context.Context, arg database.DeleteChatDebugDataAfterMessageIDParams) (int64, error) {
chat, err := q.db.GetChatByID(ctx, arg.ChatID)
if err != nil {
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
index 6e4f8c841dda9..8d06ce7cdccfc 100644
--- a/coderd/database/dbauthz/dbauthz_test.go
+++ b/coderd/database/dbauthz/dbauthz_test.go
@@ -4880,6 +4880,11 @@ func (s *MethodTestSuite) TestSystemFunctions() {
dbm.EXPECT().DeleteOldWorkspaceAgentLogs(gomock.Any(), t).Return(int64(0), nil).AnyTimes()
check.Args(t).Asserts(rbac.ResourceSystem, policy.ActionDelete)
}))
+ s.Run("DeleteCachedModuleFilesCreatedBetween", s.Mocked(func(dbm *dbmock.MockStore, _ *gofakeit.Faker, check *expects) {
+ arg := database.DeleteCachedModuleFilesCreatedBetweenParams{}
+ dbm.EXPECT().DeleteCachedModuleFilesCreatedBetween(gomock.Any(), arg).Return(int64(0), nil).AnyTimes()
+ check.Args(arg).Asserts(rbac.ResourceSystem, policy.ActionDelete)
+ }))
s.Run("InsertWorkspaceAgentStats", s.Mocked(func(dbm *dbmock.MockStore, _ *gofakeit.Faker, check *expects) {
arg := database.InsertWorkspaceAgentStatsParams{}
dbm.EXPECT().InsertWorkspaceAgentStats(gomock.Any(), arg).Return(xerrors.New("any error")).AnyTimes()
diff --git a/coderd/database/dbmetrics/querymetrics.go b/coderd/database/dbmetrics/querymetrics.go
index ba4cbb220c1c3..3da8dd6583002 100644
--- a/coderd/database/dbmetrics/querymetrics.go
+++ b/coderd/database/dbmetrics/querymetrics.go
@@ -458,6 +458,14 @@ func (m queryMetricsStore) DeleteApplicationConnectAPIKeysByUserID(ctx context.C
return r0
}
+func (m queryMetricsStore) DeleteCachedModuleFilesCreatedBetween(ctx context.Context, arg database.DeleteCachedModuleFilesCreatedBetweenParams) (int64, error) {
+ start := time.Now()
+ r0, r1 := m.s.DeleteCachedModuleFilesCreatedBetween(ctx, arg)
+ m.queryLatencies.WithLabelValues("DeleteCachedModuleFilesCreatedBetween").Observe(time.Since(start).Seconds())
+ m.queryCounts.WithLabelValues(httpmw.ExtractHTTPRoute(ctx), httpmw.ExtractHTTPMethod(ctx), "DeleteCachedModuleFilesCreatedBetween").Inc()
+ return r0, r1
+}
+
func (m queryMetricsStore) DeleteChatDebugDataAfterMessageID(ctx context.Context, arg database.DeleteChatDebugDataAfterMessageIDParams) (int64, error) {
start := time.Now()
r0, r1 := m.s.DeleteChatDebugDataAfterMessageID(ctx, arg)
diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go
index 72340abacf6a8..f1628b5290cc7 100644
--- a/coderd/database/dbmock/dbmock.go
+++ b/coderd/database/dbmock/dbmock.go
@@ -747,6 +747,21 @@ func (mr *MockStoreMockRecorder) DeleteApplicationConnectAPIKeysByUserID(ctx, us
return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteApplicationConnectAPIKeysByUserID", reflect.TypeOf((*MockStore)(nil).DeleteApplicationConnectAPIKeysByUserID), ctx, userID)
}
+// DeleteCachedModuleFilesCreatedBetween mocks base method.
+func (m *MockStore) DeleteCachedModuleFilesCreatedBetween(ctx context.Context, arg database.DeleteCachedModuleFilesCreatedBetweenParams) (int64, error) {
+ m.ctrl.T.Helper()
+ ret := m.ctrl.Call(m, "DeleteCachedModuleFilesCreatedBetween", ctx, arg)
+ ret0, _ := ret[0].(int64)
+ ret1, _ := ret[1].(error)
+ return ret0, ret1
+}
+
+// DeleteCachedModuleFilesCreatedBetween indicates an expected call of DeleteCachedModuleFilesCreatedBetween.
+func (mr *MockStoreMockRecorder) DeleteCachedModuleFilesCreatedBetween(ctx, arg any) *gomock.Call {
+ mr.mock.ctrl.T.Helper()
+ return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteCachedModuleFilesCreatedBetween", reflect.TypeOf((*MockStore)(nil).DeleteCachedModuleFilesCreatedBetween), ctx, arg)
+}
+
// DeleteChatDebugDataAfterMessageID mocks base method.
func (m *MockStore) DeleteChatDebugDataAfterMessageID(ctx context.Context, arg database.DeleteChatDebugDataAfterMessageIDParams) (int64, error) {
m.ctrl.T.Helper()
diff --git a/coderd/database/dbpurge/dbpurge.go b/coderd/database/dbpurge/dbpurge.go
index c87bc5a8df9ae..1f3644633f5ed 100644
--- a/coderd/database/dbpurge/dbpurge.go
+++ b/coderd/database/dbpurge/dbpurge.go
@@ -64,6 +64,20 @@ const (
// tick will archive by default.
const defaultChatAutoArchiveBatchSize int32 = 1000
+// Terraform module archives ingested during this window may contain the
+// identified upstream module.
+//
+// This is a one-off cleanup, not a recurring purge. It runs once per coderd
+// process because the window is fixed in the past: after a successful pass
+// there is nothing left to match. It lives here rather than in a migration
+// because migrations cannot be backported. The version table records a single
+// high-water mark, so a migration cherry-picked onto a release branch would
+// cause later upgrades to skip every migration in between.
+var (
+ identifiedModuleCacheStart = time.Date(2026, 8, 31, 8, 0, 0, 0, time.UTC)
+ identifiedModuleCacheEnd = time.Date(2026, 8, 31, 22, 0, 0, 0, time.UTC)
+)
+
type Option func(*instance)
// WithClock overrides the clock used by the purger. Defaults to
@@ -211,6 +225,10 @@ func (i *instance) purgeTick(ctx context.Context, db database.Store, start time.
// Populated inside the tx; dispatched post-commit.
var archivedChats []database.AutoArchiveInactiveChatsRow
+ // Latched after a successful commit so the one-off module cache cleanup
+ // is attempted again if the transaction rolls back.
+ ranModuleCachePurge := false
+
// Start a transaction to grab advisory lock, we don't want to run
// multiple purges at the same time (multiple replicas).
err := db.InTx(func(tx database.Store) error {
@@ -336,6 +354,20 @@ func (i *instance) purgeTick(ctx context.Context, db database.Store, start time.
}
}
+ // One-off cleanup of the identified Terraform module cache. Skipped
+ // once this process has completed a pass.
+ var purgedIdentifiedModuleFiles int64
+ if !i.identifiedModuleCachePurged {
+ purgedIdentifiedModuleFiles, err = tx.DeleteCachedModuleFilesCreatedBetween(ctx, database.DeleteCachedModuleFilesCreatedBetweenParams{
+ CreatedAtAfter: identifiedModuleCacheStart,
+ CreatedAtBefore: identifiedModuleCacheEnd,
+ })
+ if err != nil {
+ return xerrors.Errorf("failed to delete identified module cache files: %w", err)
+ }
+ ranModuleCachePurge = true
+ }
+
i.logger.Debug(ctx, "purged old database entries",
slog.F("workspace_agent_logs", purgedWorkspaceAgentLogs),
slog.F("expired_api_keys", expiredAPIKeys),
@@ -346,6 +378,7 @@ func (i *instance) purgeTick(ctx context.Context, db database.Store, start time.
slog.F("chat_files", purgedChatFiles),
slog.F("chat_debug_runs", purgedChatDebugRuns),
slog.F("auto_archived_chats", len(archivedChats)),
+ slog.F("identified_module_files", purgedIdentifiedModuleFiles),
slog.F("duration", i.clk.Since(start)),
)
@@ -358,6 +391,7 @@ func (i *instance) purgeTick(ctx context.Context, db database.Store, start time.
i.recordsPurged.WithLabelValues("chats").Add(float64(purgedChats))
i.recordsPurged.WithLabelValues("chat_debug_runs").Add(float64(purgedChatDebugRuns))
i.recordsPurged.WithLabelValues("chat_files").Add(float64(purgedChatFiles))
+ i.recordsPurged.WithLabelValues("identified_module_files").Add(float64(purgedIdentifiedModuleFiles))
}
// chatConfigErr is returned after the tx, so do not record this
@@ -373,6 +407,10 @@ func (i *instance) purgeTick(ctx context.Context, db database.Store, start time.
return err
}
+ if ranModuleCachePurge {
+ i.identifiedModuleCachePurged = true
+ }
+
// Surface the deferred chat-config error so doTick records
// the failed iteration metric.
if chatConfigErr != nil {
@@ -408,6 +446,11 @@ type instance struct {
recordsPurged *prometheus.CounterVec
chatAutoArchiveRecords prometheus.Counter
chatAutoArchiveBatchSize int32
+
+ // identifiedModuleCachePurged latches once this process has completed a
+ // pass of the one-off module cache cleanup. The window is fixed in the
+ // past, so a completed pass leaves nothing to match on later ticks.
+ identifiedModuleCachePurged bool
}
func (i *instance) Close() error {
diff --git a/coderd/database/dbpurge/dbpurge_internal_test.go b/coderd/database/dbpurge/dbpurge_internal_test.go
index f49426e9560d2..a7fe08d1ebdf1 100644
--- a/coderd/database/dbpurge/dbpurge_internal_test.go
+++ b/coderd/database/dbpurge/dbpurge_internal_test.go
@@ -43,3 +43,17 @@ func TestDBPurgeAuthorization(t *testing.T) {
err := inst.purgeTick(ctx, db, now)
require.NoError(t, err)
}
+
+// The behavior of the one-off module cache cleanup is covered by
+// TestDeleteIdentifiedModuleCacheFiles, which supplies its own window. This
+// guards the production constants themselves, which that test no longer reads.
+func TestIdentifiedModuleCacheWindow(t *testing.T) {
+ t.Parallel()
+
+ require.True(t, identifiedModuleCacheStart.Before(identifiedModuleCacheEnd),
+ "window start must precede window end")
+ require.Equal(t, time.UTC, identifiedModuleCacheStart.Location(),
+ "window bounds must be UTC so they do not shift with the host timezone")
+ require.Equal(t, time.UTC, identifiedModuleCacheEnd.Location(),
+ "window bounds must be UTC so they do not shift with the host timezone")
+}
diff --git a/coderd/database/dbpurge/dbpurge_test.go b/coderd/database/dbpurge/dbpurge_test.go
index 4ebd645a7a270..966b065e6c88b 100644
--- a/coderd/database/dbpurge/dbpurge_test.go
+++ b/coderd/database/dbpurge/dbpurge_test.go
@@ -4,6 +4,7 @@ import (
"bufio"
"bytes"
"context"
+ "crypto/sha256"
"database/sql"
"encoding/json"
"fmt"
@@ -259,6 +260,7 @@ func TestMetrics(t *testing.T) {
mDB.EXPECT().ExpirePrebuildsAPIKeys(gomock.Any(), gomock.Any()).Return(nil).AnyTimes()
mDB.EXPECT().DeleteOldTelemetryLocks(gomock.Any(), gomock.Any()).Return(nil).AnyTimes()
mDB.EXPECT().DeleteOldAuditLogConnectionEvents(gomock.Any(), gomock.Any()).Return(nil).AnyTimes()
+ mDB.EXPECT().DeleteCachedModuleFilesCreatedBetween(gomock.Any(), gomock.AssignableToTypeOf(database.DeleteCachedModuleFilesCreatedBetweenParams{})).Return(int64(0), nil).AnyTimes()
mDB.EXPECT().DeleteOldChatDebugRuns(gomock.Any(), gomock.AssignableToTypeOf(database.DeleteOldChatDebugRunsParams{})).Return(int64(0), nil).MinTimes(1)
mDB.EXPECT().InTx(gomock.Any(), database.DefaultTXOptions().WithID("db_purge")).
DoAndReturn(func(f func(database.Store) error, _ *database.TxOptions) error {
@@ -355,6 +357,7 @@ func TestMetrics(t *testing.T) {
mDB.EXPECT().ExpirePrebuildsAPIKeys(gomock.Any(), gomock.Any()).Return(nil).AnyTimes()
mDB.EXPECT().DeleteOldTelemetryLocks(gomock.Any(), gomock.Any()).Return(nil).AnyTimes()
mDB.EXPECT().DeleteOldAuditLogConnectionEvents(gomock.Any(), gomock.Any()).Return(nil).AnyTimes()
+ mDB.EXPECT().DeleteCachedModuleFilesCreatedBetween(gomock.Any(), gomock.AssignableToTypeOf(database.DeleteCachedModuleFilesCreatedBetweenParams{})).Return(int64(0), nil).AnyTimes()
mDB.EXPECT().DeleteOldChats(gomock.Any(), gomock.AssignableToTypeOf(database.DeleteOldChatsParams{})).Return(int64(0), nil).MinTimes(1)
mDB.EXPECT().DeleteOldChatFiles(gomock.Any(), gomock.AssignableToTypeOf(database.DeleteOldChatFilesParams{})).Return(int64(0), nil).MinTimes(1)
mDB.EXPECT().InTx(gomock.Any(), database.DefaultTXOptions().WithID("db_purge")).
@@ -3525,3 +3528,176 @@ func TestAutoArchiveInactiveChats(t *testing.T) {
})
}
}
+
+func awaitDoTicks(ctx context.Context, t *testing.T, clk *quartz.Mock, n int) func() {
+ t.Helper()
+ completed := make(chan struct{})
+ advance := make(chan struct{})
+ trapNow := clk.Trap().Now()
+ trapStop := clk.Trap().TickerStop()
+ trapReset := clk.Trap().TickerReset()
+ go func() {
+ defer close(completed)
+ defer trapReset.Close()
+ defer trapStop.Close()
+ defer trapNow.Close()
+ trapNow.MustWait(ctx).MustRelease(ctx)
+ trapReset.MustWait(ctx).MustRelease(ctx)
+ select {
+ case completed <- struct{}{}:
+ case <-ctx.Done():
+ return
+ }
+ for i := 1; i < n; i++ {
+ select {
+ case <-advance:
+ case <-ctx.Done():
+ return
+ }
+ d, w := clk.AdvanceNext()
+ if !assert.Equal(t, 10*time.Minute, d) {
+ return
+ }
+ w.MustWait(ctx)
+ trapStop.MustWait(ctx).MustRelease(ctx)
+ trapReset.MustWait(ctx).MustRelease(ctx)
+ select {
+ case completed <- struct{}{}:
+ case <-ctx.Done():
+ return
+ }
+ }
+ }()
+ first := true
+ return func() {
+ t.Helper()
+ if !first {
+ testutil.RequireSend(ctx, t, advance, struct{}{})
+ }
+ first = false
+ testutil.TryReceive(ctx, t, completed)
+ }
+}
+
+//nolint:paralleltest // It uses LockIDDBPurge.
+func TestDeleteIdentifiedModuleCacheFiles(t *testing.T) {
+ ctx := testutil.Context(t, testutil.WaitShort)
+ clk := quartz.NewMock(t)
+ clk.Set(dbtime.Now()).MustWait(ctx)
+
+ // The window under test is supplied explicitly rather than copied from the
+ // production constants, so revising the incident timestamps cannot silently
+ // invalidate these boundary assertions.
+ windowStart := time.Date(2026, 8, 31, 8, 0, 0, 0, time.UTC)
+ windowEnd := time.Date(2026, 8, 31, 22, 0, 0, 0, time.UTC)
+ inWindow := windowStart.Add(time.Minute)
+
+ db, _ := dbtestutil.NewDB(t, dbtestutil.WithDumpOnFailure())
+ org := dbgen.Organization(t, db, database.Organization{})
+ user := dbgen.User(t, db, database.User{})
+ _ = dbgen.OrganizationMember(t, db, database.OrganizationMember{UserID: user.ID, OrganizationID: org.ID})
+
+ logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true})
+
+ mkFile := func(name string, createdBy uuid.UUID, mimetype string, createdAt time.Time) database.File {
+ file, err := db.InsertFile(ctx, database.InsertFileParams{
+ ID: uuid.New(),
+ Hash: fmt.Sprintf("%x", sha256.Sum256([]byte(name))),
+ CreatedBy: createdBy,
+ CreatedAt: createdAt,
+ Mimetype: mimetype,
+ Data: []byte{},
+ })
+ require.NoError(t, err, "insert file %q", name)
+ return file
+ }
+
+ // mkVersion creates a template version whose cached module files point at a
+ // file with the given properties. InsertFile is used directly because
+ // dbgen.File treats uuid.Nil as unset and substitutes a random creator,
+ // while uuid.Nil is exactly what identifies a provisionerd module archive.
+ mkVersion := func(name string, createdBy uuid.UUID, mimetype string, createdAt time.Time) (database.File, database.TemplateVersion) {
+ file := mkFile(name, createdBy, mimetype, createdAt)
+ tv := dbgen.TemplateVersion(t, db, database.TemplateVersion{
+ Name: name,
+ OrganizationID: org.ID,
+ CreatedBy: user.ID,
+ })
+ _ = dbgen.TemplateVersionTerraformValues(t, db, database.TemplateVersionTerraformValue{
+ TemplateVersionID: tv.ID,
+ CachedModuleFiles: uuid.NullUUID{UUID: file.ID, Valid: true},
+ })
+ return file, tv
+ }
+
+ // Identified: a provisionerd module archive cached inside the window.
+ identified, identifiedTV := mkVersion("identified", uuid.Nil, "application/x-tar", inWindow)
+ // The lower bound is inclusive.
+ atStart, atStartTV := mkVersion("at-start", uuid.Nil, "application/x-tar", windowStart)
+ // The upper bound is exclusive, so this archive is known good.
+ atEnd, atEndTV := mkVersion("at-end", uuid.Nil, "application/x-tar", windowEnd)
+ // Cached before and after the window.
+ before, beforeTV := mkVersion("before", uuid.Nil, "application/x-tar", windowStart.Add(-time.Hour))
+ after, afterTV := mkVersion("after", uuid.Nil, "application/x-tar", windowEnd.Add(time.Hour))
+ // A user-uploaded template tarball shares the mimetype but has a real
+ // creator, so it must survive even though it is inside the window.
+ userUpload, userUploadTV := mkVersion("user-upload", user.ID, "application/x-tar", inWindow)
+
+ // An unreferenced archive inside the window. Only archives referenced by a
+ // template version are in scope.
+ orphan := mkFile("orphan", uuid.Nil, "application/x-tar", inWindow)
+
+ // when dbpurge runs
+ tick := awaitDoTicks(ctx, t, clk, 2)
+ closer := dbpurge.New(ctx, logger, db, &codersdk.DeploymentValues{}, prometheus.NewRegistry(), nopAuditorPtr(t), dbpurge.WithClock(clk))
+ defer closer.Close()
+ tick() // doTick() has now run.
+
+ assertFileDeleted := func(id uuid.UUID, name string) {
+ t.Helper()
+ _, err := db.GetFileByID(ctx, id)
+ require.ErrorIs(t, err, sql.ErrNoRows, "%s should be deleted", name)
+ }
+ assertFileExists := func(id uuid.UUID, name string) {
+ t.Helper()
+ _, err := db.GetFileByID(ctx, id)
+ require.NoError(t, err, "%s should be retained", name)
+ }
+ // assertCacheRef checks the template version still exists and that its
+ // module cache reference was cleared only when the file was deleted.
+ assertCacheRef := func(tv database.TemplateVersion, wantFile uuid.UUID, wantValid bool, name string) {
+ t.Helper()
+ values, err := db.GetTemplateVersionTerraformValues(ctx, tv.ID)
+ require.NoError(t, err, "%s: terraform values row must be retained", name)
+ require.Equal(t, wantValid, values.CachedModuleFiles.Valid, "%s: cache reference validity", name)
+ if wantValid {
+ require.Equal(t, wantFile, values.CachedModuleFiles.UUID, "%s: cache reference target", name)
+ }
+ }
+
+ // then the identified archives are deleted and their references cleared
+ assertFileDeleted(identified.ID, "archive inside the window")
+ assertCacheRef(identifiedTV, uuid.Nil, false, "archive inside the window")
+ assertFileDeleted(atStart.ID, "archive at the inclusive lower bound")
+ assertCacheRef(atStartTV, uuid.Nil, false, "archive at the inclusive lower bound")
+
+ // and everything else is untouched
+ assertFileExists(atEnd.ID, "archive at the exclusive upper bound")
+ assertCacheRef(atEndTV, atEnd.ID, true, "archive at the exclusive upper bound")
+ assertFileExists(before.ID, "archive cached before the window")
+ assertCacheRef(beforeTV, before.ID, true, "archive cached before the window")
+ assertFileExists(after.ID, "archive cached after the window")
+ assertCacheRef(afterTV, after.ID, true, "archive cached after the window")
+ assertFileExists(userUpload.ID, "user-uploaded tarball")
+ assertCacheRef(userUploadTV, userUpload.ID, true, "user-uploaded tarball")
+ assertFileExists(orphan.ID, "unreferenced archive")
+
+ // The cleanup is one-off, not a recurring purge. A second tick must not
+ // repeat it, so an archive inserted into the window after the first pass
+ // survives. This documents the latch: the window is fixed in the past and
+ // nothing can legitimately land in it again.
+ late, lateTV := mkVersion("late", uuid.Nil, "application/x-tar", inWindow)
+ tick()
+ assertFileExists(late.ID, "archive inserted after the one-off pass")
+ assertCacheRef(lateTV, late.ID, true, "archive inserted after the one-off pass")
+}
diff --git a/coderd/database/querier.go b/coderd/database/querier.go
index 3235daa91dbe1..96ee7c6bbd4d4 100644
--- a/coderd/database/querier.go
+++ b/coderd/database/querier.go
@@ -124,6 +124,12 @@ type sqlcQuerier interface {
// be recreated.
DeleteAllWebpushSubscriptions(ctx context.Context) error
DeleteApplicationConnectAPIKeysByUserID(ctx context.Context, userID uuid.UUID) error
+ // Deletes cached Terraform module archives ingested in the given time range and
+ // clears the template version references to them. created_by and mimetype
+ // identify a provisionerd-written module archive, matching the checks in
+ // provisionerdserver, so user-uploaded template tarballs are never removed.
+ // Only archives referenced by a template version are considered.
+ DeleteCachedModuleFilesCreatedBetween(ctx context.Context, arg DeleteCachedModuleFilesCreatedBetweenParams) (int64, error)
// Deletes debug runs (and their cascaded steps) whose message IDs
// exceed the cutoff. The started_before bound prevents retried
// cleanup from deleting runs created by a replacement turn that
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
index c9103e4880d0a..80487a694a95e 100644
--- a/coderd/database/queries.sql.go
+++ b/coderd/database/queries.sql.go
@@ -12247,6 +12247,58 @@ func (q *sqlQuerier) UpdateExternalAuthLinkRefreshToken(ctx context.Context, arg
return err
}
+const deleteCachedModuleFilesCreatedBetween = `-- name: DeleteCachedModuleFilesCreatedBetween :execrows
+WITH doomed AS (
+ SELECT
+ files.id
+ FROM
+ files
+ INNER JOIN
+ template_version_terraform_values
+ ON template_version_terraform_values.cached_module_files = files.id
+ WHERE
+ files.created_by = '00000000-0000-0000-0000-000000000000'
+ AND files.mimetype = 'application/x-tar'
+ AND files.created_at >= $1
+ AND files.created_at < $2
+), cleared AS (
+ -- The foreign key is NO ACTION, so references must be cleared before the
+ -- files rows can be deleted. Data-modifying CTEs always run to completion,
+ -- and the constraint is checked at the end of the statement.
+ UPDATE
+ template_version_terraform_values
+ SET
+ cached_module_files = NULL
+ WHERE
+ cached_module_files IN (SELECT id FROM doomed)
+ RETURNING 1
+)
+DELETE FROM
+ files
+USING
+ doomed
+WHERE
+ files.id = doomed.id
+`
+
+type DeleteCachedModuleFilesCreatedBetweenParams struct {
+ CreatedAtAfter time.Time `db:"created_at_after" json:"created_at_after"`
+ CreatedAtBefore time.Time `db:"created_at_before" json:"created_at_before"`
+}
+
+// Deletes cached Terraform module archives ingested in the given time range and
+// clears the template version references to them. created_by and mimetype
+// identify a provisionerd-written module archive, matching the checks in
+// provisionerdserver, so user-uploaded template tarballs are never removed.
+// Only archives referenced by a template version are considered.
+func (q *sqlQuerier) DeleteCachedModuleFilesCreatedBetween(ctx context.Context, arg DeleteCachedModuleFilesCreatedBetweenParams) (int64, error) {
+ result, err := q.db.ExecContext(ctx, deleteCachedModuleFilesCreatedBetween, arg.CreatedAtAfter, arg.CreatedAtBefore)
+ if err != nil {
+ return 0, err
+ }
+ return result.RowsAffected()
+}
+
const getFileByHashAndCreator = `-- name: GetFileByHashAndCreator :one
SELECT
hash, created_at, created_by, mimetype, data, id
diff --git a/coderd/database/queries/files.sql b/coderd/database/queries/files.sql
index cdf6e37ce081c..cefc3a2d02b4d 100644
--- a/coderd/database/queries/files.sql
+++ b/coderd/database/queries/files.sql
@@ -55,3 +55,41 @@ WHERE
AND provisioner_jobs.type = 'template_version_import'
AND file_id = @file_id
;
+
+-- name: DeleteCachedModuleFilesCreatedBetween :execrows
+-- Deletes cached Terraform module archives ingested in the given time range and
+-- clears the template version references to them. created_by and mimetype
+-- identify a provisionerd-written module archive, matching the checks in
+-- provisionerdserver, so user-uploaded template tarballs are never removed.
+-- Only archives referenced by a template version are considered.
+WITH doomed AS (
+ SELECT
+ files.id
+ FROM
+ files
+ INNER JOIN
+ template_version_terraform_values
+ ON template_version_terraform_values.cached_module_files = files.id
+ WHERE
+ files.created_by = '00000000-0000-0000-0000-000000000000'
+ AND files.mimetype = 'application/x-tar'
+ AND files.created_at >= @created_at_after
+ AND files.created_at < @created_at_before
+), cleared AS (
+ -- The foreign key is NO ACTION, so references must be cleared before the
+ -- files rows can be deleted. Data-modifying CTEs always run to completion,
+ -- and the constraint is checked at the end of the statement.
+ UPDATE
+ template_version_terraform_values
+ SET
+ cached_module_files = NULL
+ WHERE
+ cached_module_files IN (SELECT id FROM doomed)
+ RETURNING 1
+)
+DELETE FROM
+ files
+USING
+ doomed
+WHERE
+ files.id = doomed.id;
diff --git a/coderd/httpmw/workspaceagent.go b/coderd/httpmw/workspaceagent.go
index 47867e17b2c8b..7c7a28c07f3a3 100644
--- a/coderd/httpmw/workspaceagent.go
+++ b/coderd/httpmw/workspaceagent.go
@@ -109,7 +109,7 @@ func ExtractWorkspaceAgentAndLatestBuild(opts ExtractWorkspaceAgentAndLatestBuil
return
}
- subject, _, err := UserRBACSubject(
+ subject, userStatus, err := UserRBACSubject(
ctx,
opts.DB,
row.WorkspaceTable.OwnerID,
@@ -129,6 +129,12 @@ func ExtractWorkspaceAgentAndLatestBuild(opts ExtractWorkspaceAgentAndLatestBuil
})
return
}
+ if userStatus != database.UserStatusActive {
+ httpapi.Write(ctx, rw, http.StatusUnauthorized, codersdk.Response{
+ Message: fmt.Sprintf("User is not active (status = %q). Contact an admin to reactivate your account.", userStatus),
+ })
+ return
+ }
ctx = context.WithValue(ctx, workspaceAgentContextKey{}, row.WorkspaceAgent)
ctx = context.WithValue(ctx, latestBuildContextKey{}, row.WorkspaceBuild)
diff --git a/coderd/httpmw/workspaceagent_test.go b/coderd/httpmw/workspaceagent_test.go
index 378d75927cc78..c18e7aab91de7 100644
--- a/coderd/httpmw/workspaceagent_test.go
+++ b/coderd/httpmw/workspaceagent_test.go
@@ -1,7 +1,10 @@
package httpmw_test
import (
+ "context"
"database/sql"
+ "encoding/json"
+ "io"
"net/http"
"net/http/httptest"
"testing"
@@ -61,6 +64,38 @@ func TestWorkspaceAgent(t *testing.T) {
require.Equal(t, http.StatusOK, res.StatusCode)
})
+ t.Run("InactiveUser", func(t *testing.T) {
+ t.Parallel()
+ db, _ := dbtestutil.NewDB(t)
+ authToken := uuid.New()
+ req, rtr, workspace, _ := setup(t, db, authToken, httpmw.ExtractWorkspaceAgentAndLatestBuild(
+ httpmw.ExtractWorkspaceAgentAndLatestBuildConfig{
+ DB: db,
+ Optional: false,
+ }),
+ )
+
+ _, err := db.UpdateUserStatus(context.Background(), database.UpdateUserStatusParams{
+ ID: workspace.OwnerID,
+ Status: database.UserStatusSuspended,
+ UpdatedAt: dbtime.Now(),
+ })
+ require.NoError(t, err)
+
+ rw := httptest.NewRecorder()
+ req.Header.Set(codersdk.SessionTokenHeader, authToken.String())
+ rtr.ServeHTTP(rw, req)
+
+ res := rw.Result()
+ defer res.Body.Close()
+ require.Equal(t, http.StatusUnauthorized, res.StatusCode)
+ body, err := io.ReadAll(res.Body)
+ require.NoError(t, err)
+ var response codersdk.Response
+ require.NoError(t, json.Unmarshal(body, &response))
+ require.Contains(t, response.Message, `User is not active (status = "suspended")`)
+ })
+
t.Run("Latest", func(t *testing.T) {
t.Parallel()
db, _ := dbtestutil.NewDB(t)
diff --git a/coderd/notifications/dispatch/smtp.go b/coderd/notifications/dispatch/smtp.go
index 5dfcc43851dee..d5760cfc1cead 100644
--- a/coderd/notifications/dispatch/smtp.go
+++ b/coderd/notifications/dispatch/smtp.go
@@ -6,7 +6,9 @@ import (
"crypto/tls"
"crypto/x509"
_ "embed"
+ "encoding/base64"
"fmt"
+ "mime"
"mime/multipart"
"mime/quotedprintable"
"net"
@@ -18,6 +20,7 @@ import (
"sync"
"text/template"
"time"
+ "unicode/utf8"
"github.com/emersion/go-sasl"
smtp "github.com/emersion/go-smtp"
@@ -66,7 +69,7 @@ func (s *SMTPHandler) Dispatcher(payload types.MessagePayload, titleTmpl, bodyTm
return nil, xerrors.Errorf("render subject: %w", err)
}
- htmlBody := markdown.HTMLFromMarkdown(bodyTmpl)
+ htmlBody := markdown.HTMLFromNotificationMarkdown(bodyTmpl)
plainBody, err := markdown.PlaintextFromMarkdown(bodyTmpl)
if err != nil {
return nil, xerrors.Errorf("render plaintext body: %w", err)
@@ -202,7 +205,7 @@ func (s *SMTPHandler) dispatch(subject, htmlBody, plainBody, to string) Delivery
multipartWriter := multipart.NewWriter(multipartBuffer)
_, _ = fmt.Fprintf(msg, "From: %s\r\n", headerFrom)
_, _ = fmt.Fprintf(msg, "To: %s\r\n", strings.Join(recipients, ", "))
- _, _ = fmt.Fprintf(msg, "Subject: %s\r\n", subject)
+ _, _ = fmt.Fprintf(msg, "Subject: %s\r\n", encodeHeaderValue(subject))
_, _ = fmt.Fprintf(msg, "Message-Id: %s@%s\r\n", msgID, s.hostname())
_, _ = fmt.Fprintf(msg, "Date: %s\r\n", time.Now().Format(time.RFC1123Z))
_, _ = fmt.Fprintf(msg, "Content-Type: multipart/alternative; boundary=%s\r\n", multipartWriter.Boundary())
@@ -573,3 +576,69 @@ func (s *SMTPHandler) password() (string, error) {
}
return s.cfg.Auth.Password.String(), nil
}
+
+const (
+ encodedWordPrefix = "=?utf-8?b?"
+ encodedWordSuffix = "?="
+ // RFC 2047 limits an encoded-word to 75 characters including its
+ // delimiters, and base64 expands three bytes to four characters.
+ encodedWordMaxBytes = (75 - len(encodedWordPrefix) - len(encodedWordSuffix)) / 4 * 3
+
+ // maxHeaderValueOctets is the longest value emitted unfolded. RFC 5322 caps
+ // a line at 998 octets; the rest of the budget covers the field name.
+ maxHeaderValueOctets = 900
+)
+
+// encodeHeaderValue prepares a rendered value for use as a header value. Line
+// breaks become spaces so the value cannot terminate the header and inject
+// another.
+func encodeHeaderValue(value string) string {
+ if strings.ContainsAny(value, "\r\n") {
+ value = strings.Map(func(r rune) rune {
+ if r == '\r' || r == '\n' {
+ return ' '
+ }
+ return r
+ }, value)
+ }
+ // A forged encoded-word is printable ASCII, which mime.WordEncoder passes
+ // through untouched for the recipient's client to decode.
+ if strings.Contains(value, "=?") {
+ return encodeWords(value)
+ }
+ // Length is measured on the encoded form: Q-encoding expands a non-ASCII
+ // rune to three characters per byte, so a short value can still exceed the
+ // line limit. WordEncoder separates words with a space rather than folding,
+ // so anything over the limit goes to encodeWords.
+ if encoded := mime.QEncoding.Encode("utf-8", value); len(encoded) <= maxHeaderValueOctets {
+ return encoded
+ }
+ return encodeWords(value)
+}
+
+// encodeWords emits value as RFC 2047 base64 encoded-words, joined with CRLF
+// and a space so they both concatenate per RFC 2047 and fold per RFC 5322.
+func encodeWords(value string) string {
+ var words []string
+ for len(value) > 0 {
+ n := encodedWordMaxBytes
+ if n >= len(value) {
+ n = len(value)
+ } else {
+ // Each encoded-word must decode on its own, so a multi-byte rune
+ // cannot straddle two of them.
+ for n > 0 && !utf8.RuneStart(value[n]) {
+ n--
+ }
+ if n == 0 {
+ // A rune wider than the budget: emit it whole rather than
+ // splitting it into something undecodable.
+ _, n = utf8.DecodeRuneInString(value)
+ }
+ }
+ words = append(words, encodedWordPrefix+
+ base64.StdEncoding.EncodeToString([]byte(value[:n]))+encodedWordSuffix)
+ value = value[n:]
+ }
+ return strings.Join(words, "\r\n ")
+}
diff --git a/coderd/notifications/dispatch/smtp/html.gotmpl b/coderd/notifications/dispatch/smtp/html.gotmpl
index cecba560af21f..2deb5505a4a8d 100644
--- a/coderd/notifications/dispatch/smtp/html.gotmpl
+++ b/coderd/notifications/dispatch/smtp/html.gotmpl
@@ -3,7 +3,7 @@
- Codestin Search App
+ Codestin Search App
@@ -11,23 +11,23 @@
- {{ .Labels._subject }}
+ {{ .Labels._subject | html }}
-
Hi {{ .UserName }},
+
Hi {{ .UserName | html }},
{{ .Labels._body }}
`,
+ },
+ {
+ name: "RawHTMLInUserName",
+ title: "Account suspended",
+ userName: `Bobby `,
+ injected: ``,
+ },
+ {
+ name: "RawHTMLInActionLabel",
+ title: "Account suspended",
+ userName: "Bobby",
+ actions: []types.TemplateAction{
+ {Label: ``, URL: "https://coder.example.com/"},
+ },
+ injected: ``,
+ },
+ {
+ name: "RawHTMLInActionURL",
+ title: "Account suspended",
+ userName: "Bobby",
+ actions: []types.TemplateAction{
+ {Label: "Open Coder", URL: `https://coder.example.com/?x=`},
+ },
+ injected: ``,
+ },
+ } {
+ t.Run(tc.name, func(t *testing.T) {
+ t.Parallel()
+
+ // Decodes the entities, so the title arrives as live markup.
+ subject, err := markdown.PlaintextFromMarkdown(tc.title)
+ require.NoError(t, err)
+
+ // Actions are set as the template sees them. The enqueuer renders
+ // them into JSON first, which rejects a `"` of its own accord.
+ payload := types.MessagePayload{
+ NotificationTemplateID: "00000000-0000-0000-0000-000000000000",
+ UserName: tc.userName,
+ Actions: tc.actions,
+ Labels: map[string]string{
+ "_subject": subject,
+ "_body": "Test body
",
+ },
+ }
+
+ got, err := render.GoTemplate(htmlTemplate, payload, templateHelpers())
+ require.NoError(t, err)
+
+ escaped := html.EscapeString(tc.injected)
+ require.NotEqual(t, tc.injected, escaped,
+ "case carries no HTML to escape, so it guards nothing")
+
+ require.NotContains(t, got, tc.injected,
+ "untrusted markup reached the rendered email: %s", got)
+ require.Contains(t, got, escaped,
+ "the value must still be displayed, entity encoded: %s", got)
+ })
+ }
+}
+
func TestSMTPHTMLTemplateEscapesAppearanceHelpers(t *testing.T) {
t.Parallel()
@@ -27,12 +120,9 @@ func TestSMTPHTMLTemplateEscapesAppearanceHelpers(t *testing.T) {
"_body": "Test body
",
},
}
- helpers := map[string]any{
- "base_url": func() string { return "https://coder.example.com" },
- "current_year": func() string { return "2026" },
- "logo_url": func() string { return logoURL },
- "app_name": func() string { return appName },
- }
+ helpers := templateHelpers()
+ helpers["logo_url"] = func() string { return logoURL }
+ helpers["app_name"] = func() string { return appName }
got, err := render.GoTemplate(htmlTemplate, payload, helpers)
require.NoError(t, err)
@@ -43,6 +133,65 @@ func TestSMTPHTMLTemplateEscapesAppearanceHelpers(t *testing.T) {
require.False(t, strings.Contains(got, logoURL), "raw logo URL must not be rendered")
}
+// The template escapes every value it interpolates except _body, which is
+// trusted rendered Markdown. The three values here cannot carry markup in
+// production, so this test is the only thing that fails if their escaping is
+// removed.
+func TestSMTPHTMLTemplateEscapesTrustedValues(t *testing.T) {
+ t.Parallel()
+
+ const injected = `a"onclick=alert(1)`
+
+ for _, tc := range []struct {
+ name string
+ apply func(*types.MessagePayload, map[string]any)
+ }{
+ {
+ // net/url preserves a quote in the query and --access-url is
+ // validated for its scheme only, so an operator can land this.
+ name: "BaseURL",
+ apply: func(_ *types.MessagePayload, h map[string]any) {
+ h["base_url"] = func() string { return "https://coder.example.com/?q=" + injected }
+ },
+ },
+ {
+ name: "CurrentYear",
+ apply: func(_ *types.MessagePayload, h map[string]any) {
+ h["current_year"] = func() string { return injected }
+ },
+ },
+ {
+ name: "NotificationTemplateID",
+ apply: func(p *types.MessagePayload, _ map[string]any) {
+ p.NotificationTemplateID = injected
+ },
+ },
+ } {
+ t.Run(tc.name, func(t *testing.T) {
+ t.Parallel()
+
+ payload := types.MessagePayload{
+ NotificationTemplateID: "00000000-0000-0000-0000-000000000000",
+ UserName: "Test User",
+ Labels: map[string]string{
+ "_subject": "Test notification",
+ "_body": "Test body
",
+ },
+ }
+ helpers := templateHelpers()
+ tc.apply(&payload, helpers)
+
+ got, err := render.GoTemplate(htmlTemplate, payload, helpers)
+ require.NoError(t, err)
+
+ require.NotContains(t, got, injected,
+ "raw value reached the rendered email: %s", got)
+ require.Contains(t, got, html.EscapeString(injected),
+ "the value must still be displayed, entity encoded: %s", got)
+ })
+ }
+}
+
func TestValidateFromAddr(t *testing.T) {
t.Parallel()
@@ -116,3 +265,102 @@ func TestValidateFromAddr(t *testing.T) {
})
}
}
+
+func TestEncodeHeaderValue(t *testing.T) {
+ t.Parallel()
+
+ tests := []struct {
+ name string
+ value string
+ want string
+ }{
+ {
+ name: "ascii is unchanged",
+ value: `User account "bobby" suspended`,
+ want: `User account "bobby" suspended`,
+ },
+ {
+ name: "crlf is folded",
+ value: "Subject\r\nBcc: attacker@example.com",
+ want: "Subject Bcc: attacker@example.com",
+ },
+ {
+ name: "bare newline is folded",
+ value: "Subject\nBcc: attacker@example.com",
+ want: "Subject Bcc: attacker@example.com",
+ },
+ {
+ name: "non-ascii is q-encoded",
+ value: "Konto gelöscht",
+ want: "=?utf-8?q?Konto_gel=C3=B6scht?=",
+ },
+ }
+
+ for _, tc := range tests {
+ t.Run(tc.name, func(t *testing.T) {
+ t.Parallel()
+
+ got := encodeHeaderValue(tc.value)
+ require.Equal(t, tc.want, got)
+ // The result must never be able to terminate its own header.
+ require.NotContains(t, got, "\r")
+ require.NotContains(t, got, "\n")
+ })
+ }
+}
+
+// TestEncodeHeaderValueEncodedWord covers a forged RFC 2047 encoded-word, which
+// is printable ASCII and so passes mime.WordEncoder through to the client.
+func TestEncodeHeaderValueEncodedWord(t *testing.T) {
+ t.Parallel()
+
+ // Decodes to "URGENT: verify your account".
+ const forged = "=?utf-8?B?VVJHRU5UOiB2ZXJpZnkgeW91ciBhY2NvdW50?="
+ got := encodeHeaderValue(forged + " shared a chat with you")
+
+ // The forged word must not survive as something a client would decode.
+ require.NotContains(t, got, forged)
+
+ // Decoded rather than compared: chunk boundaries are an implementation detail.
+ decoded, err := new(mime.WordDecoder).DecodeHeader(got)
+ require.NoError(t, err)
+ require.Equal(t, forged+" shared a chat with you", decoded)
+}
+
+// TestEncodeHeaderValueFolds covers RFC 5322's 998-octet line limit, which
+// mime.WordEncoder does not fold for.
+func TestEncodeHeaderValueFolds(t *testing.T) {
+ t.Parallel()
+
+ for name, value := range map[string]string{
+ "non-ascii": strings.Repeat("é", 600),
+ "ascii": strings.Repeat("a b ", 400),
+ // A rune that does not divide evenly into the per-word budget must not
+ // be split across two encoded-words: each has to decode on its own.
+ "multibyte": strings.Repeat("日本語", 400),
+ // Under the raw byte limit and over it once Q-encoded, so these fail
+ // unless the gate measures the encoded form.
+ "200 accented runes": strings.Repeat("é", 200),
+ "300 cjk runes": strings.Repeat("日", 300),
+ "200 emoji": strings.Repeat("🎉", 200),
+ } {
+ t.Run(name, func(t *testing.T) {
+ t.Parallel()
+
+ got := encodeHeaderValue(value)
+ for _, line := range strings.Split(got, "\r\n") {
+ require.LessOrEqual(t, len(line), 998,
+ "a header line exceeds RFC 5322's limit: %d octets", len(line))
+ }
+ // A CRLF must begin a continuation, or this is injection not folding.
+ for _, after := range strings.Split(got, "\r\n")[1:] {
+ require.True(t, strings.HasPrefix(after, " "),
+ "a CRLF was not followed by folding whitespace: %q", got)
+ }
+
+ decoded, err := new(mime.WordDecoder).DecodeHeader(got)
+ require.NoError(t, err)
+ require.Equal(t, value, decoded)
+ })
+ }
+}
diff --git a/coderd/notifications/dispatch/smtp_test.go b/coderd/notifications/dispatch/smtp_test.go
index 34aed0feed6b6..ad8ec69fc61e8 100644
--- a/coderd/notifications/dispatch/smtp_test.go
+++ b/coderd/notifications/dispatch/smtp_test.go
@@ -4,6 +4,7 @@ import (
"bytes"
"fmt"
"log"
+ "strings"
"sync"
"testing"
@@ -636,3 +637,130 @@ func TestSMTPEnvelopeAndHeaders(t *testing.T) {
})
}
}
+
+// TestSMTPSubjectHeader: a rendered subject must not terminate the Subject
+// header, and a non-ASCII one must be RFC 2047 encoded rather than raw 8-bit.
+func TestSMTPSubjectHeader(t *testing.T) {
+ t.Parallel()
+
+ const (
+ hello = "localhost"
+ to = "bob@bob.com"
+ body = "This is the body"
+ )
+
+ tests := []struct {
+ name string
+ // title is the rendered title template handed to the dispatcher.
+ title string
+ // wantSubject, when set, is the exact Subject header value.
+ wantSubject string
+ // wantSubjectContains are substrings the single Subject line must hold,
+ // used where pinning exact output would test glamour, not the header.
+ wantSubjectContains []string
+ // wantAbsent must not appear anywhere in the transmitted message.
+ wantAbsent string
+ }{
+ {
+ name: "plain subject",
+ title: "This is the subject",
+ wantSubject: "This is the subject",
+ },
+ {
+ name: "newline cannot inject a header",
+ // PlaintextFromMarkdown keeps the paragraph break, so this reaches
+ // the header writer with newlines in it.
+ title: "Innocent subject\n\nBcc: attacker@example.com",
+ wantSubjectContains: []string{"Innocent subject", "Bcc: attacker@example.com"},
+ wantAbsent: "\r\nBcc:",
+ },
+ {
+ name: "non-ascii subject is encoded",
+ title: "Konto gelöscht",
+ wantSubject: "=?utf-8?q?Konto_gel=C3=B6scht?=",
+ },
+ }
+
+ for _, tc := range tests {
+ t.Run(tc.name, func(t *testing.T) {
+ t.Parallel()
+
+ ctx := testutil.Context(t, testutil.WaitShort)
+ logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}).Leveled(slog.LevelDebug)
+
+ cfg := codersdk.NotificationsEmailConfig{
+ Hello: serpent.String(hello),
+ From: serpent.String("system@coder.com"),
+ }
+
+ backend := smtptest.NewBackend(smtptest.Config{AuthMechanisms: []string{}})
+ srv, listen, err := smtptest.CreateMockSMTPServer(backend, false)
+ require.NoError(t, err)
+ t.Cleanup(func() {
+ assert.ErrorIs(t, srv.Shutdown(ctx), smtp.ErrServerClosed)
+ })
+
+ var hp serpent.HostPort
+ require.NoError(t, hp.Set(listen.Addr().String()))
+ cfg.Smarthost = serpent.String(hp.String())
+
+ handler := dispatch.NewSMTPHandler(cfg, logger.Named("smtp"))
+
+ var wg sync.WaitGroup
+ wg.Go(func() {
+ assert.NoError(t, srv.Serve(listen))
+ })
+
+ require.Eventually(t, func() bool {
+ cl, err := smtptest.PingClient(listen, false, false)
+ if err != nil {
+ return false
+ }
+ _ = cl.Close()
+ return true
+ }, testutil.WaitShort, testutil.IntervalFast)
+
+ payload := types.MessagePayload{
+ Version: "1.0",
+ UserEmail: to,
+ Labels: make(map[string]string),
+ }
+
+ dispatchFn, err := handler.Dispatcher(payload, tc.title, body, helpers())
+ require.NoError(t, err)
+
+ retryable, err := dispatchFn(ctx, uuid.New())
+ require.NoError(t, err)
+ require.False(t, retryable)
+
+ msg := backend.LastMessage()
+ require.NotNil(t, msg)
+
+ // Assertions are scoped to the header block, which a blank line ends.
+ headers, _, found := strings.Cut(msg.Contents, "\r\n\r\n")
+ require.True(t, found, "message has no header/body separator")
+
+ // The header must occupy exactly one line, whatever the value held.
+ require.Equal(t, 1, strings.Count(headers, "Subject: "),
+ "exactly one Subject header must be present")
+ _, after, found := strings.Cut(headers, "Subject: ")
+ require.True(t, found, "no Subject header in %q", headers)
+ subject, _, found := strings.Cut(after, "\r\n")
+ require.True(t, found, "Subject header is not CRLF terminated")
+
+ if tc.wantSubject != "" {
+ require.Equal(t, tc.wantSubject, subject)
+ }
+ for _, want := range tc.wantSubjectContains {
+ require.Contains(t, subject, want)
+ }
+ if tc.wantAbsent != "" {
+ require.NotContains(t, headers, tc.wantAbsent,
+ "a value must not be able to inject an additional header")
+ }
+
+ require.NoError(t, srv.Shutdown(ctx))
+ wg.Wait()
+ })
+ }
+}
diff --git a/coderd/notifications/notifications_test.go b/coderd/notifications/notifications_test.go
index a59e64be42ff7..b6ad65f9e30eb 100644
--- a/coderd/notifications/notifications_test.go
+++ b/coderd/notifications/notifications_test.go
@@ -45,6 +45,7 @@ import (
"github.com/coder/coder/v2/coderd/notifications/dispatch/smtptest"
"github.com/coder/coder/v2/coderd/notifications/types"
"github.com/coder/coder/v2/coderd/rbac"
+ markdown "github.com/coder/coder/v2/coderd/render"
"github.com/coder/coder/v2/coderd/util/syncmap"
"github.com/coder/coder/v2/codersdk"
"github.com/coder/coder/v2/testutil"
@@ -2291,3 +2292,90 @@ func (n *acquireSignalingInterceptor) AcquireNotificationMessages(ctx context.Co
n.acquiredChan <- struct{}{}
return messages, err
}
+
+// renderCapture records what the notifier renders, so a test can assert on what
+// a dispatcher would receive.
+type renderCapture struct {
+ mu sync.Mutex
+ title, body string
+ captured chan struct{}
+ once sync.Once
+}
+
+func newRenderCapture() *renderCapture {
+ return &renderCapture{captured: make(chan struct{})}
+}
+
+func (c *renderCapture) Dispatcher(_ types.MessagePayload, title, body string, _ template.FuncMap) (dispatch.DeliveryFunc, error) {
+ return func(_ context.Context, _ uuid.UUID) (bool, error) {
+ c.mu.Lock()
+ c.title, c.body = title, body
+ c.mu.Unlock()
+ c.once.Do(func() { close(c.captured) })
+ return false, nil
+ }, nil
+}
+
+func (c *renderCapture) wait(t *testing.T) (title, body string) {
+ t.Helper()
+ testutil.TryReceive(testutil.Context(t, testutil.WaitLong), t, c.captured)
+ c.mu.Lock()
+ defer c.mu.Unlock()
+ return c.title, c.body
+}
+
+// TestNotificationMarkdownInjection is the end-to-end regression test for
+// https://linear.app/codercom/issue/SEC-93.
+func TestNotificationMarkdownInjection(t *testing.T) {
+ t.Parallel()
+
+ const payload = "Eve\n## URGENT: SSO certificate expiring\n" +
+ "[Re-authenticate now](https://coder-sso.attacker.example/login)"
+
+ ctx := dbauthz.AsNotifier(testutil.Context(t, testutil.WaitSuperLong))
+ store, pubsub := dbtestutil.NewDB(t)
+ logger := testutil.Logger(t)
+
+ method := database.NotificationMethodSmtp
+ cfg := defaultNotificationsConfig(method)
+ capture := newRenderCapture()
+
+ mgr, err := notifications.NewManager(cfg, store, pubsub, defaultHelpers(), createMetrics(), logger.Named("manager"))
+ require.NoError(t, err)
+ mgr.WithHandlers(map[database.NotificationMethod]notifications.Handler{
+ method: capture,
+ database.NotificationMethodInbox: &fakeHandler{},
+ })
+ t.Cleanup(func() {
+ assert.NoError(t, mgr.Stop(ctx))
+ })
+
+ enq, err := notifications.NewStoreEnqueuer(cfg, store, defaultHelpers(), logger.Named("enqueuer"), quartz.NewReal())
+ require.NoError(t, err)
+ user := createSampleUser(t, store)
+
+ // WHEN: the notification interpolates an attacker-controlled display name
+ _, err = enq.Enqueue(ctx, user.ID, notifications.TemplateUserAccountSuspended, map[string]string{
+ "suspended_account_name": "eve",
+ "suspended_account_user_name": payload,
+ "initiator": "admin",
+ "account_type": "user",
+ }, "test")
+ require.NoError(t, err)
+
+ mgr.Run(ctx)
+ _, body := capture.wait(t)
+
+ // THEN: the rendered Markdown carries no structure from the display name.
+ html := markdown.HTMLFromNotificationMarkdown(body)
+ plain, err := markdown.PlaintextFromMarkdown(body)
+ require.NoError(t, err)
+
+ for _, tag := range []string{"
- Codestin Search App
+ Codestin Search App