Affected by GO-2024-3228 and 19 other vulnerabilities

GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

devtunnel

package

v2.8.5 Latest Latest Go to latest Published: Mar 9, 2024 License: AGPL-3.0 Imports: 22 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/coder/coder

Links

Open Source Insights

Documentation ¶

Index ¶

Variables
func New(ctx context.Context, logger slog.Logger, customTunnelHost string) (*tunnelsdk.Tunnel, error)
func NewWithConfig(ctx context.Context, logger slog.Logger, cfg Config) (*tunnelsdk.Tunnel, error)
type Config
- func GenerateConfig(customTunnelHost string) (Config, error)
type Node
- func FindClosestNode(nodes []Node) (Node, error)
- func Nodes(customTunnelHost string) ([]Node, error)
type Region

Constants ¶

This section is empty.

Variables ¶

View Source

var Regions = []Region{
	{
		ID:           0,
		LocationName: "US East Pittsburgh",
		Nodes: []Node{
			{
				ID:            1,
				RegionID:      0,
				HostnameHTTPS: "pit-1.try.coder.app",
			},
		},
	},
}

Functions ¶

func New ¶

func New(ctx context.Context, logger slog.Logger, customTunnelHost string) (*tunnelsdk.Tunnel, error)

New creates a tunnel with a public URL and returns a listener for incoming connections on that URL. Connections are made over the wireguard protocol. Tunnel configuration is cached in the user's config directory. Successive calls to New will always use the same URL. If multiple public URLs in parallel are required, use NewWithConfig.

This uses https://github.com/coder/wgtunnel as the server and client implementation.

func NewWithConfig ¶

func NewWithConfig(ctx context.Context, logger slog.Logger, cfg Config) (*tunnelsdk.Tunnel, error)

NewWithConfig calls New with the given config. For documentation, see New.

Types ¶

type Config ¶

type Config struct {
	Version    tunnelsdk.TunnelVersion `json:"version"`
	PrivateKey device.NoisePrivateKey  `json:"private_key"`
	PublicKey  device.NoisePublicKey   `json:"public_key"`

	Tunnel Node `json:"tunnel"`

	// Used in testing.  Normally this is nil, indicating to use DefaultClient.
	HTTPClient *http.Client `json:"-"`
}

func GenerateConfig ¶

func GenerateConfig(customTunnelHost string) (Config, error)

type Node ¶

type Node struct {
	ID            int    `json:"id"`
	RegionID      int    `json:"region_id"`
	HostnameHTTPS string `json:"hostname_https"`

	AvgLatency time.Duration `json:"-"`
}

func FindClosestNode ¶

func FindClosestNode(nodes []Node) (Node, error)

FindClosestNode pings each node and returns the one with the lowest latency.

func Nodes ¶

func Nodes(customTunnelHost string) ([]Node, error)

Nodes returns a list of nodes to use for the tunnel. It will pick a random node from each region.

If a customNode is provided, it will be returned as the only node with ID 9999.

type Region ¶

type Region struct {
	ID           int
	LocationName string
	Nodes        []Node
}

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL