From 69d42394ee94bcac26939aeb73bfd17a7fce99d2 Mon Sep 17 00:00:00 2001
From: George K <george@coder.com>
Date: Tue, 28 Jul 2026 13:20:59 -0700
Subject: [PATCH] fix(coderd): reject workspace proxy hostname prefixes
 (#27544)

A workspace proxy hostname prefix could be accepted as a valid proxy
access URL. An authenticated user could then be redirected to an
attacker-controlled domain with an application-connect API key in the
URL.

Require proxy access URL matches to have a hostname boundary after the
candidate hostname, allowing only the end of the URL, a port, or a
path.

Add regression coverage for proxy access URL and wildcard hostname
prefixes.

Refs: https://linear.app/codercom/issue/PLAT-384

---------

Co-authored-by: Bobby Ho <bobbidinho@gmail.com>
(cherry picked from commit 8cc7f2bb0e0b33199393cc3773c7d691bd2fbf6b)
---
 coderd/database/querier_test.go     | 52 +++++++++++++++++++++++++++++
 coderd/database/queries.sql.go      |  2 +-
 coderd/database/queries/proxies.sql |  2 +-
 coderd/workspaceapps_test.go        |  9 +++++
 4 files changed, 63 insertions(+), 2 deletions(-)

diff --git a/coderd/database/querier_test.go b/coderd/database/querier_test.go
index 5e8571e93b2..9a453bc2f2f 100644
--- a/coderd/database/querier_test.go
+++ b/coderd/database/querier_test.go
@@ -1841,6 +1841,16 @@ func TestProxyByHostname(t *testing.T) {
 			accessURL:        "https://two.coder.com",
 			wildcardHostname: "*--suffix.two.coder.com",
 		},
+		{
+			name:             "three",
+			accessURL:        "https://three.coder.com:8443",
+			wildcardHostname: "*.wildcard.three.coder.com",
+		},
+		{
+			name:             "four",
+			accessURL:        "https://four.coder.com/",
+			wildcardHostname: "*.wildcard.four.coder.com",
+		},
 	}
 	for _, p := range proxies {
 		dbgen.WorkspaceProxy(t, db, database.WorkspaceProxy{
@@ -1871,6 +1881,34 @@ func TestProxyByHostname(t *testing.T) {
 			allowWildcardHost: true,
 			matchProxyName:    "one",
 		},
+		{
+			name:              "MatchAccessURLWithPort",
+			testHostname:      "three.coder.com",
+			allowAccessURL:    true,
+			allowWildcardHost: false,
+			matchProxyName:    "three",
+		},
+		{
+			name:              "MatchAccessURLWithTrailingSlash",
+			testHostname:      "four.coder.com",
+			allowAccessURL:    true,
+			allowWildcardHost: false,
+			matchProxyName:    "four",
+		},
+		{
+			name:              "RejectAccessURLPrefix",
+			testHostname:      "one.coder",
+			allowAccessURL:    true,
+			allowWildcardHost: false,
+			matchProxyName:    "",
+		},
+		{
+			name:              "RejectAccessURLTLDPrefix",
+			testHostname:      "one.coder.co",
+			allowAccessURL:    true,
+			allowWildcardHost: false,
+			matchProxyName:    "",
+		},
 		{
 			name:              "MatchWildcard",
 			testHostname:      "something.wildcard.one.coder.com",
@@ -1878,6 +1916,13 @@ func TestProxyByHostname(t *testing.T) {
 			allowWildcardHost: true,
 			matchProxyName:    "one",
 		},
+		{
+			name:              "RejectWildcardHostnamePrefix",
+			testHostname:      "something.wildcard.one.coder",
+			allowAccessURL:    false,
+			allowWildcardHost: true,
+			matchProxyName:    "",
+		},
 		{
 			name:              "MatchSuffix",
 			testHostname:      "something--suffix.two.coder.com",
@@ -1885,6 +1930,13 @@ func TestProxyByHostname(t *testing.T) {
 			allowWildcardHost: true,
 			matchProxyName:    "two",
 		},
+		{
+			name:              "RejectSuffixHostnamePrefix",
+			testHostname:      "something--suffix.two.coder",
+			allowAccessURL:    false,
+			allowWildcardHost: true,
+			matchProxyName:    "",
+		},
 		{
 			name:              "ValidateHostname/1",
 			testHostname:      ".*ne.coder.com",
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
index 2e2e8a919b4..f6fe41c0287 100644
--- a/coderd/database/queries.sql.go
+++ b/coderd/database/queries.sql.go
@@ -21702,7 +21702,7 @@ WHERE
 	(
 		(
 			$2 :: bool = true AND
-			url SIMILAR TO '[^:]*://' || $1 :: text || '([:/]?%)*'
+			url SIMILAR TO '[^:]*://' || $1 :: text || '([:/]%)*'
 		) OR
 		(
 			$3 :: bool = true AND
diff --git a/coderd/database/queries/proxies.sql b/coderd/database/queries/proxies.sql
index df59d3baf10..cac44de84d4 100644
--- a/coderd/database/queries/proxies.sql
+++ b/coderd/database/queries/proxies.sql
@@ -120,7 +120,7 @@ WHERE
 	(
 		(
 			@allow_access_url :: bool = true AND
-			url SIMILAR TO '[^:]*://' || @hostname :: text || '([:/]?%)*'
+			url SIMILAR TO '[^:]*://' || @hostname :: text || '([:/]%)*'
 		) OR
 		(
 			@allow_wildcard_hostname :: bool = true AND
diff --git a/coderd/workspaceapps_test.go b/coderd/workspaceapps_test.go
index 8db2858e01e..db6f77ab951 100644
--- a/coderd/workspaceapps_test.go
+++ b/coderd/workspaceapps_test.go
@@ -115,6 +115,15 @@ func TestWorkspaceApplicationAuth(t *testing.T) {
 			redirectURI:      "https://proxy.test.coder.com/path",
 			expectRedirect:   "https://proxy.test.coder.com/path",
 		},
+		{
+			name:             "RejectProxyAccessURLPrefix",
+			accessURL:        "https://test.coder.com",
+			appHostname:      "*.test.coder.com",
+			proxyURL:         "https://proxy.test.coder.com",
+			proxyAppHostname: "*.proxy.test.coder.com",
+			redirectURI:      "https://proxy.test.coder/path",
+			expectRedirect:   "",
+		},
 		{
 			name:             "ProxySubdomainOK",
 			accessURL:        "https://test.coder.com",