Affected by GO-2026-5906 and 18 other vulnerabilities

GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

chatd

package

v2.32.4 Latest Latest Go to latest Published: May 19, 2026 License: AGPL-3.0 Imports: 15 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/coder/coder

Links

Open Source Insights

Documentation ¶

Index ¶

Constants
func NewMultiReplicaSubscribeFn(cfg MultiReplicaSubscribeConfig) osschatd.SubscribeFn
type MultiReplicaSubscribeConfig

Constants ¶

View Source

const RelaySourceHeader = "X-Coder-Relay-Source-Replica"

RelaySourceHeader marks replica-relayed stream requests.

Variables ¶

This section is empty.

Functions ¶

func NewMultiReplicaSubscribeFn ¶

func NewMultiReplicaSubscribeFn(
	cfg MultiReplicaSubscribeConfig,
) osschatd.SubscribeFn

NewMultiReplicaSubscribeFn returns a SubscribeFn that manages relay connections to remote replicas and returns relay message_part events only. OSS handles pubsub subscription, message catch-up, queue updates, status forwarding, and local parts merging.

Types ¶

type MultiReplicaSubscribeConfig ¶

type MultiReplicaSubscribeConfig struct {
	ResolveReplicaAddress func(context.Context, uuid.UUID) (string, bool)
	ReplicaHTTPClient     *http.Client
	ReplicaIDFn           func() uuid.UUID
	DialerFn              func(
		ctx context.Context,
		chatID uuid.UUID,
		workerID uuid.UUID,
		requestHeader http.Header,
	) (
		snapshot []codersdk.ChatStreamEvent,
		parts <-chan codersdk.ChatStreamEvent,
		cancel func(),
		err error,
	)
	// Clock is used for creating timers. In production use
	// quartz.NewReal(); in tests use quartz.NewMock(t) to
	// control reconnect timing deterministically.
	Clock quartz.Clock
}

MultiReplicaSubscribeConfig holds the dependencies for multi-replica chat subscription. ReplicaIDFn is called lazily because the replica ID may not be known at construction time.

DialerFn, when set, overrides the default WebSocket relay dialer. This is used in tests to inject mock relay behavior without requiring real HTTP servers.

Source Files ¶

View all Source files

chatd.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL