Affected by GO-2025-3938 and 19 other vulnerabilities

GO-2025-3938: Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder

GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

dbcrypt

package

v2.23.0 Latest Latest Go to latest Published: Jun 3, 2025 License: AGPL-3.0 Imports: 14 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/coder/coder

Links

Open Source Insights

Documentation ¶

Overview ¶

Package dbcrypt provides a database.Store wrapper that encrypts/decrypts values stored at rest in the database.

Encryption is done using Ciphers, which is an abstraction over a set of encryption keys. Each key has a unique identifier, which is used to uniquely identify the key whilst maintaining secrecy.

Currently, AES-256-GCM is the only implemented cipher mode. The Cipher is currently used to encrypt/decrypt the following fields: - database.UserLink.OAuthAccessToken - database.UserLink.OAuthRefreshToken - database.GitAuthLink.OAuthAccessToken - database.GitAuthLink.OAuthRefreshToken - database.DBCryptSentinelValue

Multiple ciphers can be provided to support key rotation. The primary cipher is used to encrypt and decrypt all data. Secondary ciphers are only used for decryption and, as a general rule, should only be active when rotating keys.

Encryption keys are stored in the database in the table `dbcrypt_keys`. The table has the following schema:

number: the key number. This is used to avoid conflicts when rotating keys.
created_at: the time the key was created.
active_key_digest: the SHA256 digest of the active key. If null, the key has been revoked.
revoked_key_digest: the SHA256 digest of the revoked key. If null, the key has not been revoked.
revoked_at: the time the key was revoked. If null, the key has not been revoked.
test: the encrypted value of the string "coder". This is used to ensure that the key is valid.

Encrypted fields are stored in the database as a base64-encoded string. Each encrypted column MUST have a corresponding _key_id column that is a foreign key reference to `dbcrypt_keys.active_key_digest`. This ensures that a key cannot be revoked until all rows that use that key have been migrated to a new key.

Index ¶

func Decrypt(ctx context.Context, log slog.Logger, sqlDB *sql.DB, ciphers []Cipher) error
func Delete(ctx context.Context, log slog.Logger, sqlDB *sql.DB) error
func New(ctx context.Context, db database.Store, ciphers ...Cipher) (database.Store, error)
func Rotate(ctx context.Context, log slog.Logger, sqlDB *sql.DB, ciphers []Cipher) error
type Cipher
- func NewCiphers(keys ...[]byte) ([]Cipher, error)
type DecryptFailedError
- func (e *DecryptFailedError) Error() string

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

func Decrypt ¶

func Decrypt(ctx context.Context, log slog.Logger, sqlDB *sql.DB, ciphers []Cipher) error

Decrypt decrypts all user tokens and revokes all ciphers.

func Delete ¶

func Delete(ctx context.Context, log slog.Logger, sqlDB *sql.DB) error

Delete deletes all user tokens and revokes all ciphers. This is a destructive operation and should only be used as a last resort, for example, if the database encryption key has been lost.

func New ¶

func New(ctx context.Context, db database.Store, ciphers ...Cipher) (database.Store, error)

New creates a database.Store wrapper that encrypts/decrypts values stored at rest in the database.

func Rotate ¶

func Rotate(ctx context.Context, log slog.Logger, sqlDB *sql.DB, ciphers []Cipher) error

Rotate rotates the database encryption keys by re-encrypting all user tokens with the first cipher and revoking all other ciphers.

Types ¶

type Cipher ¶

type Cipher interface {
	Encrypt([]byte) ([]byte, error)
	Decrypt([]byte) ([]byte, error)
	HexDigest() string
}

func NewCiphers ¶

func NewCiphers(keys ...[]byte) ([]Cipher, error)

NewCiphers is a convenience function for creating multiple ciphers. It currently only supports AES-256-GCM.

type DecryptFailedError ¶

type DecryptFailedError struct {
	Inner error
}

DecryptFailedError is returned when decryption fails.

func (*DecryptFailedError) Error ¶

func (e *DecryptFailedError) Error() string

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL