Affected by GO-2024-3228
and 19 other vulnerabilities
GO-2024-3228 : Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder
GO-2025-3921 : Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder
GO-2025-4182 : Coder logs sensitive objects unsanitized in github.com/coder/coder
GO-2026-5169 : Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder
GO-2026-5196 : Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder
GO-2026-5897 : Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder
GO-2026-5906 : Coder: User-admin role can reset owner account password in github.com/coder/coder
GO-2026-5907 : Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder
GO-2026-5908 : Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder
GO-2026-5909 : Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder
GO-2026-5913 : Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder
GO-2026-5915 : Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder
GO-2026-5917 : Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder
GO-2026-5918 : Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder
GO-2026-5919 : Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder
GO-2026-5922 : Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder
GO-2026-5924 : Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder
GO-2026-5926 : Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder
GO-2026-6265 : Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder
GO-2026-6267 : Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder
Discover Packages
github.com/coder/coder/v2
coderd
database
dbtestutil
package
Version:
v2.11.1
Opens a new window with list of versions in this module.
Published: May 16, 2024
License: AGPL-3.0
Opens a new window with license information.
Imports: 25
Opens a new window with list of imports.
Imported by: 0
Opens a new window with list of known importers.
Documentation
Documentation
¶
Rendered for
linux/amd64
windows/amd64
darwin/amd64
js/wasm
func DumpOnFailure(t testing.TB, connectionURL string)
func NewDB(t testing.TB, opts ...Option) (database.Store, pubsub.Pubsub)
func NewDBWithSQLDB(t testing.TB, opts ...Option) (database.Store, pubsub.Pubsub, *sql.DB)
func Open() (string, func(), error)
func OpenContainerized(port int) (string, func(), error)
func PGDump(dbURL string) ([]byte, error)
func PGDumpSchemaOnly(dbURL string) ([]byte, error)
func WillUsePostgres() bool
type Option
DumpOnFailure exports the database referenced by connectionURL to a file
corresponding to the current test, with a suffix indicating the time the
test was run.
To import this into a new database (assuming you have already run make test-postgres-docker):
Create a new test database:
go run ./scripts/migrate-ci/main.go and note the database name it outputs
Import the file into the above database:
psql 'postgres://postgres:postgres@127.0.0.1:5432/<dbname>?sslmode=disable' -f <path to file.test.sql>
Run a dev server against that database:
./scripts/coder-dev.sh server --postgres-url='postgres://postgres:postgres@127.0.0.1:5432/<dbname>?sslmode=disable'
Open creates a new PostgreSQL database instance. With DB_FROM environment variable set, it clones a database
from the provided template. With the environment variable unset, it creates a new Docker container running postgres.
OpenContainerized creates a new PostgreSQL server using a Docker container. If port is nonzero, forward host traffic
to that port to the database. If port is zero, allocate a free port from the OS.
PGDump runs pg_dump against dbURL and returns the output.
It is used by DumpOnFailure().
PGDumpSchemaOnly is for use by gen/dump only.
It runs pg_dump against dbURL and sets a consistent timezone and encoding.
func WillUsePostgres() bool
WillUsePostgres returns true if a call to NewDB() will return a real, postgres-backed Store and Pubsub.
type Option func(*options)
func WithDumpOnFailure() Option
WithDumpOnFailure will dump the entire database on test failure.
WithTimezone sets the database to the defined timezone.
Source Files
¶
Directories
¶
Click to show internal directories.
Click to hide internal directories.