Skip to content

Commit 815baf9

Browse files
EmyrkEmyrk
committed
Return vague 404
1 parent a6d15ed commit 815baf9

20 files changed

+79
-77
lines changed

‎coderd/files.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,7 @@ func (api *API) fileByHash(rw http.ResponseWriter, r *http.Request) {
8787
}
8888
file, err := api.Database.GetFileByHash(r.Context(), hash)
8989
if errors.Is(err, sql.ErrNoRows) {
90-
httpapi.ResourceNotFound(rw, fmt.Sprintf("File %q", hash))
90+
httpapi.ResourceNotFound(rw)
9191
return
9292
}
9393
if err != nil {
@@ -101,7 +101,7 @@ func (api *API) fileByHash(rw http.ResponseWriter, r *http.Request) {
101101
if !api.Authorize(r, rbac.ActionRead,
102102
rbac.ResourceFile.WithOwner(file.CreatedBy.String()).WithID(file.Hash)) {
103103
// Return 404 to not leak the file exists
104-
httpapi.ResourceNotFound(rw, fmt.Sprintf("File %q", hash))
104+
httpapi.ResourceNotFound(rw)
105105
return
106106
}
107107

‎coderd/gitsshkey.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ func (api *API) regenerateGitSSHKey(rw http.ResponseWriter, r *http.Request) {
1515
user := httpmw.UserParam(r)
1616

1717
if !api.Authorize(r, rbac.ActionUpdate, rbac.ResourceUserData.WithOwner(user.ID.String())) {
18-
httpapi.Forbidden(rw)
18+
httpapi.ResourceNotFound(rw)
1919
return
2020
}
2121

@@ -64,7 +64,7 @@ func (api *API) gitSSHKey(rw http.ResponseWriter, r *http.Request) {
6464
user := httpmw.UserParam(r)
6565

6666
if !api.Authorize(r, rbac.ActionRead, rbac.ResourceUserData.WithOwner(user.ID.String())) {
67-
httpapi.Forbidden(rw)
67+
httpapi.ResourceNotFound(rw)
6868
return
6969
}
7070

‎coderd/httpapi/httpapi.go

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -76,9 +76,11 @@ type Error struct {
7676
Detail string `json:"detail" validate:"required"`
7777
}
7878

79-
func ResourceNotFound(rw http.ResponseWriter, resource string) {
79+
// ResourceNotFound is intentionally vague. All 404 responses should be identical
80+
// to prevent leaking existence of resources.
81+
func ResourceNotFound(rw http.ResponseWriter) {
8082
Write(rw, http.StatusNotFound, Response{
81-
Message: fmt.Sprintf("%s does not exist.", resource),
83+
Message: fmt.Sprintf("Resource not found"),
8284
})
8385
}
8486

‎coderd/httpmw/organizationparam.go

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ import (
44
"context"
55
"database/sql"
66
"errors"
7-
"fmt"
87
"net/http"
98

109
"github.com/coder/coder/coderd/database"
@@ -45,7 +44,7 @@ func ExtractOrganizationParam(db database.Store) func(http.Handler) http.Handler
4544

4645
organization, err := db.GetOrganizationByID(r.Context(), orgID)
4746
if errors.Is(err, sql.ErrNoRows) {
48-
httpapi.ResourceNotFound(rw, fmt.Sprintf("Organization %q", orgID))
47+
httpapi.ResourceNotFound(rw)
4948
return
5049
}
5150
if err != nil {

‎coderd/httpmw/templateparam.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ func ExtractTemplateParam(db database.Store) func(http.Handler) http.Handler {
4747
}
4848

4949
if template.Deleted {
50-
httpapi.ResourceNotFound(rw, fmt.Sprintf("Template %q", templateID))
50+
httpapi.ResourceNotFound(rw)
5151
return
5252
}
5353

‎coderd/httpmw/templateversionparam.go

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ import (
44
"context"
55
"database/sql"
66
"errors"
7-
"fmt"
87
"net/http"
98

109
"github.com/go-chi/chi/v5"
@@ -34,7 +33,7 @@ func ExtractTemplateVersionParam(db database.Store) func(http.Handler) http.Hand
3433
}
3534
templateVersion, err := db.GetTemplateVersionByID(r.Context(), templateVersionID)
3635
if errors.Is(err, sql.ErrNoRows) {
37-
httpapi.ResourceNotFound(rw, fmt.Sprintf("Template version %q", templateVersionID))
36+
httpapi.ResourceNotFound(rw)
3837
return
3938
}
4039
if err != nil {

‎coderd/httpmw/userparam.go

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,11 @@ package httpmw
22

33
import (
44
"context"
5+
"database/sql"
56
"net/http"
67

8+
"golang.org/x/xerrors"
9+
710
"github.com/go-chi/chi/v5"
811
"github.com/google/uuid"
912

@@ -47,6 +50,10 @@ func ExtractUserParam(db database.Store) func(http.Handler) http.Handler {
4750

4851
if userQuery == "me" {
4952
user, err = db.GetUserByID(r.Context(), APIKey(r).UserID)
53+
if xerrors.Is(err, sql.ErrNoRows) {
54+
httpapi.ResourceNotFound(rw)
55+
return
56+
}
5057
if err != nil {
5158
httpapi.Write(rw, http.StatusInternalServerError, httpapi.Response{
5259
Message: "Internal error fetching user.",

‎coderd/httpmw/workspacebuildparam.go

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ import (
44
"context"
55
"database/sql"
66
"errors"
7-
"fmt"
87
"net/http"
98

109
"github.com/go-chi/chi/v5"
@@ -34,7 +33,7 @@ func ExtractWorkspaceBuildParam(db database.Store) func(http.Handler) http.Handl
3433
}
3534
workspaceBuild, err := db.GetWorkspaceBuildByID(r.Context(), workspaceBuildID)
3635
if errors.Is(err, sql.ErrNoRows) {
37-
httpapi.ResourceNotFound(rw, fmt.Sprintf("Workspace build %q", workspaceBuildID))
36+
httpapi.ResourceNotFound(rw)
3837
return
3938
}
4039
if err != nil {

‎coderd/httpmw/workspaceparam.go

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ import (
44
"context"
55
"database/sql"
66
"errors"
7-
"fmt"
87
"net/http"
98

109
"github.com/coder/coder/coderd/database"
@@ -32,7 +31,7 @@ func ExtractWorkspaceParam(db database.Store) func(http.Handler) http.Handler {
3231
}
3332
workspace, err := db.GetWorkspaceByID(r.Context(), workspaceID)
3433
if errors.Is(err, sql.ErrNoRows) {
35-
httpapi.ResourceNotFound(rw, fmt.Sprintf("Workspace %q", workspaceID))
34+
httpapi.ResourceNotFound(rw)
3635
return
3736
}
3837
if err != nil {

‎coderd/organizations.go

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ func (api *API) organization(rw http.ResponseWriter, r *http.Request) {
2222
if !api.Authorize(r, rbac.ActionRead, rbac.ResourceOrganization.
2323
InOrg(organization.ID).
2424
WithID(organization.ID.String())) {
25-
httpapi.ResourceNotFound(rw, fmt.Sprintf("Organization %q", organization.ID))
25+
httpapi.ResourceNotFound(rw)
2626
return
2727
}
2828

@@ -33,8 +33,7 @@ func (api *API) postOrganizations(rw http.ResponseWriter, r *http.Request) {
3333
apiKey := httpmw.APIKey(r)
3434
// Create organization uses the organization resource without an OrgID.
3535
// This means you need the site wide permission to make a new organization.
36-
if !api.Authorize(r, rbac.ActionCreate,
37-
rbac.ResourceOrganization) {
36+
if !api.Authorize(r, rbac.ActionCreate, rbac.ResourceOrganization) {
3837
httpapi.Forbidden(rw)
3938
return
4039
}

0 commit comments

Comments
 (0)