GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

The highest tagged major version is v2.

license

package

v0.27.3 Latest Latest Go to latest Published: Aug 1, 2023 License: AGPL-3.0 Imports: 11 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/coder/coder

Links

Open Source Insights

Documentation ¶

Index ¶

Constants ¶

View Source

const (
	CurrentVersion        = 3
	HeaderKeyID           = "kid"
	AccountTypeSalesforce = "salesforce"
	VersionClaim          = "version"
)

Variables ¶

View Source

var (
	ValidMethods = []string{"EdDSA"}

	ErrInvalidVersion        = xerrors.New("license must be version 3")
	ErrMissingKeyID          = xerrors.Errorf("JOSE header must contain %s", HeaderKeyID)
	ErrMissingLicenseExpires = xerrors.New("license missing license_expires")
)

Functions ¶

func Entitlements ¶

func Entitlements(
	ctx context.Context,
	db database.Store,
	logger slog.Logger,
	replicaCount int,
	gitAuthCount int,
	keys map[string]ed25519.PublicKey,
	enablements map[codersdk.FeatureName]bool,
) (codersdk.Entitlements, error)

Entitlements processes licenses to return whether features are enabled or not.

func ParseRaw ¶ added in v0.12.8

func ParseRaw(l string, keys map[string]ed25519.PublicKey) (jwt.MapClaims, error)

ParseRaw consumes a license and returns the claims.

Types ¶

type Claims ¶

type Claims struct {
	jwt.RegisteredClaims
	// LicenseExpires is the end of the legit license term, and the start of the grace period, if
	// there is one.  The standard JWT claim "exp" (ExpiresAt in jwt.RegisteredClaims, above) is
	// the end of the grace period (identical to LicenseExpires if there is no grace period).
	// The reason we use the standard claim for the end of the grace period is that we want JWT
	// processing libraries to consider the token "valid" until then.
	LicenseExpires   *jwt.NumericDate `json:"license_expires,omitempty"`
	AccountType      string           `json:"account_type,omitempty"`
	AccountID        string           `json:"account_id,omitempty"`
	Trial            bool             `json:"trial"`
	AllFeatures      bool             `json:"all_features"`
	Version          uint64           `json:"version"`
	Features         Features         `json:"features"`
	RequireTelemetry bool             `json:"require_telemetry,omitempty"`
}

func ParseClaims ¶ added in v0.12.8

func ParseClaims(rawJWT string, keys map[string]ed25519.PublicKey) (*Claims, error)

ParseClaims validates a database.License record, and if valid, returns the claims. If unparsable or invalid, it returns an error

type Features ¶

type Features map[codersdk.FeatureName]int64

Source Files ¶

View all Source files

license.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL