Skip to content

Commit 83deae6

Browse files
spikecurtisspikecurtis
committed
Merge branch 'main' of https://github.com/coder/coder into spike/9165-provisioner-filesystem
2 parents 0412773 + f35423c commit 83deae6

File tree

112 files changed

+3260
-1506
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

112 files changed

+3260
-1506
lines changed

‎.prettierrc.yaml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,17 +2,17 @@
22
# formatting for prettier-supported files. See `.editorconfig` and
33
# `site/.editorconfig`for whitespace formatting options.
44
printWidth: 80
5+
proseWrap: always
56
semi: false
67
trailingComma: all
78
useTabs: false
89
tabWidth: 2
910
overrides:
1011
- files:
1112
- README.md
13+
- docs/api/**/*.md
14+
- docs/cli/**/*.md
15+
- .github/**/*.{yaml,yml,toml}
16+
- scripts/**/*.{yaml,yml,toml}
1217
options:
1318
proseWrap: preserve
14-
- files:
15-
- "site/**/*.yaml"
16-
- "site/**/*.yml"
17-
options:
18-
proseWrap: always

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ You can run the install script with `--dry-run` to see the commands that will be
7474
7575
Once installed, you can start a production deployment<sup>1</sup> with a single command:
7676

77-
```console
77+
```shell
7878
# Automatically sets up an external access URL on *.try.coder.app
7979
coder server
8080

‎SECURITY.md

Lines changed: 47 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# Coder Security
22

3-
Coder welcomes feedback from security researchers and the general public
4-
to help improve our security. If you believe you have discovered a vulnerability,
3+
Coder welcomes feedback from security researchers and the general public to help
4+
improve our security. If you believe you have discovered a vulnerability,
55
privacy issue, exposed data, or other security issues in any of our assets, we
66
want to hear from you. This policy outlines steps for reporting vulnerabilities
77
to us, what we expect, what you can expect from us.
@@ -10,64 +10,72 @@ You can see the pretty version [here](https://coder.com/security/policy)
1010

1111
# Why Coder's security matters
1212

13-
If an attacker could fully compromise a Coder installation, they could spin
14-
up expensive workstations, steal valuable credentials, or steal proprietary
15-
source code. We take this risk very seriously and employ routine pen testing,
16-
vulnerability scanning, and code reviews. We also welcome the contributions
17-
from the community that helped make this product possible.
13+
If an attacker could fully compromise a Coder installation, they could spin up
14+
expensive workstations, steal valuable credentials, or steal proprietary source
15+
code. We take this risk very seriously and employ routine pen testing,
16+
vulnerability scanning, and code reviews. We also welcome the contributions from
17+
the community that helped make this product possible.
1818

1919
# Where should I report security issues?
2020

21-
Please report security issues to security@coder.com, providing
22-
all relevant information. The more details you provide, the easier it will be
23-
for us to triage and fix the issue.
21+
Please report security issues to security@coder.com, providing all relevant
22+
information. The more details you provide, the easier it will be for us to
23+
triage and fix the issue.
2424

2525
# Out of Scope
2626

27-
Our primary concern is around an abuse of the Coder application that allows
28-
an attacker to gain access to another users workspace, or spin up unwanted
27+
Our primary concern is around an abuse of the Coder application that allows an
28+
attacker to gain access to another users workspace, or spin up unwanted
2929
workspaces.
3030

3131
- DOS/DDOS attacks affecting availability --> While we do support rate limiting
32-
of requests, we primarily leave this to the owner of the Coder installation. Our
33-
rationale is that a DOS attack only affecting availability is not a valuable
34-
target for attackers.
32+
of requests, we primarily leave this to the owner of the Coder installation.
33+
Our rationale is that a DOS attack only affecting availability is not a
34+
valuable target for attackers.
3535
- Abuse of a compromised user credential --> If a user credential is compromised
36-
outside of the Coder ecosystem, then we consider it beyond the scope of our application.
37-
However, if an unprivileged user could escalate their permissions or gain access
38-
to another workspace, that is a cause for concern.
36+
outside of the Coder ecosystem, then we consider it beyond the scope of our
37+
application. However, if an unprivileged user could escalate their permissions
38+
or gain access to another workspace, that is a cause for concern.
3939
- Vulnerabilities in third party systems --> Vulnerabilities discovered in
40-
out-of-scope systems should be reported to the appropriate vendor or applicable authority.
40+
out-of-scope systems should be reported to the appropriate vendor or
41+
applicable authority.
4142

4243
# Our Commitments
4344

4445
When working with us, according to this policy, you can expect us to:
4546

46-
- Respond to your report promptly, and work with you to understand and validate your report;
47-
- Strive to keep you informed about the progress of a vulnerability as it is processed;
48-
- Work to remediate discovered vulnerabilities in a timely manner, within our operational constraints; and
49-
- Extend Safe Harbor for your vulnerability research that is related to this policy.
47+
- Respond to your report promptly, and work with you to understand and validate
48+
your report;
49+
- Strive to keep you informed about the progress of a vulnerability as it is
50+
processed;
51+
- Work to remediate discovered vulnerabilities in a timely manner, within our
52+
operational constraints; and
53+
- Extend Safe Harbor for your vulnerability research that is related to this
54+
policy.
5055

5156
# Our Expectations
5257

53-
In participating in our vulnerability disclosure program in good faith, we ask that you:
58+
In participating in our vulnerability disclosure program in good faith, we ask
59+
that you:
5460

55-
- Play by the rules, including following this policy and any other relevant agreements.
56-
If there is any inconsistency between this policy and any other applicable terms, the
57-
terms of this policy will prevail;
61+
- Play by the rules, including following this policy and any other relevant
62+
agreements. If there is any inconsistency between this policy and any other
63+
applicable terms, the terms of this policy will prevail;
5864
- Report any vulnerability you’ve discovered promptly;
59-
- Avoid violating the privacy of others, disrupting our systems, destroying data, and/or
60-
harming user experience;
65+
- Avoid violating the privacy of others, disrupting our systems, destroying
66+
data, and/or harming user experience;
6167
- Use only the Official Channels to discuss vulnerability information with us;
62-
- Provide us a reasonable amount of time (at least 90 days from the initial report) to
63-
resolve the issue before you disclose it publicly;
64-
- Perform testing only on in-scope systems, and respect systems and activities which
65-
are out-of-scope;
66-
- If a vulnerability provides unintended access to data: Limit the amount of data you
67-
access to the minimum required for effectively demonstrating a Proof of Concept; and
68-
cease testing and submit a report immediately if you encounter any user data during testing,
69-
such as Personally Identifiable Information (PII), Personal Healthcare Information (PHI),
70-
credit card data, or proprietary information;
71-
- You should only interact with test accounts you own or with explicit permission from
68+
- Provide us a reasonable amount of time (at least 90 days from the initial
69+
report) to resolve the issue before you disclose it publicly;
70+
- Perform testing only on in-scope systems, and respect systems and activities
71+
which are out-of-scope;
72+
- If a vulnerability provides unintended access to data: Limit the amount of
73+
data you access to the minimum required for effectively demonstrating a Proof
74+
of Concept; and cease testing and submit a report immediately if you encounter
75+
any user data during testing, such as Personally Identifiable Information
76+
(PII), Personal Healthcare Information (PHI), credit card data, or proprietary
77+
information;
78+
- You should only interact with test accounts you own or with explicit
79+
permission from
7280
- the account holder; and
7381
- Do not engage in extortion.

‎cli/parameterresolver.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -184,7 +184,7 @@ func (pr *ParameterResolver) resolveWithInput(resolved []codersdk.WorkspaceBuild
184184
if (tvp.Ephemeral && pr.promptBuildOptions) ||
185185
(action == WorkspaceCreate && tvp.Required) ||
186186
(action == WorkspaceCreate && !tvp.Ephemeral) ||
187-
(action == WorkspaceUpdate && tvp.Required) ||
187+
(action == WorkspaceUpdate && tvp.Mutable && tvp.Required) ||
188188
(action == WorkspaceUpdate && !tvp.Mutable && firstTimeUse) ||
189189
(action == WorkspaceUpdate && tvp.Mutable && !tvp.Ephemeral && pr.promptRichParameters) {
190190
parameterValue, err := cliui.RichParameter(inv, tvp)

‎cli/root_test.go

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -114,7 +114,11 @@ func TestDERPHeaders(t *testing.T) {
114114

115115
// Create a coderd API instance the hard way since we need to change the
116116
// handler to inject our custom /derp handler.
117-
setHandler, cancelFunc, serverURL, newOptions := coderdtest.NewOptions(t, nil)
117+
dv := coderdtest.DeploymentValues(t)
118+
dv.DERP.Config.BlockDirect = true
119+
setHandler, cancelFunc, serverURL, newOptions := coderdtest.NewOptions(t, &coderdtest.Options{
120+
DeploymentValues: dv,
121+
})
118122

119123
// We set the handler after server creation for the access URL.
120124
coderAPI := coderd.New(newOptions)

‎cli/update_test.go

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -565,4 +565,135 @@ func TestUpdateValidateRichParameters(t *testing.T) {
565565
}
566566
<-doneChan
567567
})
568+
569+
t.Run("ImmutableRequiredParameterExists_MutableRequiredParameterAdded", func(t *testing.T) {
570+
t.Parallel()
571+
572+
// Create template and workspace
573+
client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
574+
user := coderdtest.CreateFirstUser(t, client)
575+
576+
templateParameters := []*proto.RichParameter{
577+
{Name: stringParameterName, Type: "string", Mutable: false, Required: true, Options: []*proto.RichParameterOption{
578+
{Name: "First option", Description: "This is first option", Value: "1st"},
579+
{Name: "Second option", Description: "This is second option", Value: "2nd"},
580+
{Name: "Third option", Description: "This is third option", Value: "3rd"},
581+
}},
582+
}
583+
version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, prepareEchoResponses(templateParameters))
584+
coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
585+
template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
586+
587+
inv, root := clitest.New(t, "create", "my-workspace", "--yes", "--template", template.Name, "--parameter", fmt.Sprintf("%s=%s", stringParameterName, "2nd"))
588+
clitest.SetupConfig(t, client, root)
589+
err := inv.Run()
590+
require.NoError(t, err)
591+
592+
// Update template: add required, mutable parameter
593+
const mutableParameterName = "foobar"
594+
updatedTemplateParameters := []*proto.RichParameter{
595+
templateParameters[0],
596+
{Name: mutableParameterName, Type: "string", Mutable: true, Required: true},
597+
}
598+
599+
updatedVersion := coderdtest.UpdateTemplateVersion(t, client, user.OrganizationID, prepareEchoResponses(updatedTemplateParameters), template.ID)
600+
coderdtest.AwaitTemplateVersionJob(t, client, updatedVersion.ID)
601+
err = client.UpdateActiveTemplateVersion(context.Background(), template.ID, codersdk.UpdateActiveTemplateVersion{
602+
ID: updatedVersion.ID,
603+
})
604+
require.NoError(t, err)
605+
606+
// Update the workspace
607+
inv, root = clitest.New(t, "update", "my-workspace")
608+
clitest.SetupConfig(t, client, root)
609+
doneChan := make(chan struct{})
610+
pty := ptytest.New(t).Attach(inv)
611+
go func() {
612+
defer close(doneChan)
613+
err := inv.Run()
614+
assert.NoError(t, err)
615+
}()
616+
617+
matches := []string{
618+
mutableParameterName, "hello",
619+
"Planning workspace...", "",
620+
}
621+
for i := 0; i < len(matches); i += 2 {
622+
match := matches[i]
623+
value := matches[i+1]
624+
pty.ExpectMatch(match)
625+
626+
if value != "" {
627+
pty.WriteLine(value)
628+
}
629+
}
630+
<-doneChan
631+
})
632+
633+
t.Run("MutableRequiredParameterExists_ImmutableRequiredParameterAdded", func(t *testing.T) {
634+
t.Parallel()
635+
636+
// Create template and workspace
637+
client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
638+
user := coderdtest.CreateFirstUser(t, client)
639+
640+
templateParameters := []*proto.RichParameter{
641+
{Name: stringParameterName, Type: "string", Mutable: true, Required: true, Options: []*proto.RichParameterOption{
642+
{Name: "First option", Description: "This is first option", Value: "1st"},
643+
{Name: "Second option", Description: "This is second option", Value: "2nd"},
644+
{Name: "Third option", Description: "This is third option", Value: "3rd"},
645+
}},
646+
}
647+
version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, prepareEchoResponses(templateParameters))
648+
coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
649+
template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
650+
651+
inv, root := clitest.New(t, "create", "my-workspace", "--yes", "--template", template.Name, "--parameter", fmt.Sprintf("%s=%s", stringParameterName, "2nd"))
652+
clitest.SetupConfig(t, client, root)
653+
err := inv.Run()
654+
require.NoError(t, err)
655+
656+
// Update template: add required, immutable parameter
657+
updatedTemplateParameters := []*proto.RichParameter{
658+
templateParameters[0],
659+
{Name: immutableParameterName, Type: "string", Mutable: false, Required: true, Options: []*proto.RichParameterOption{
660+
{Name: "fir", Description: "This is first option for immutable parameter", Value: "I"},
661+
{Name: "sec", Description: "This is second option for immutable parameter", Value: "II"},
662+
{Name: "thi", Description: "This is third option for immutable parameter", Value: "III"},
663+
}},
664+
}
665+
666+
updatedVersion := coderdtest.UpdateTemplateVersion(t, client, user.OrganizationID, prepareEchoResponses(updatedTemplateParameters), template.ID)
667+
coderdtest.AwaitTemplateVersionJob(t, client, updatedVersion.ID)
668+
err = client.UpdateActiveTemplateVersion(context.Background(), template.ID, codersdk.UpdateActiveTemplateVersion{
669+
ID: updatedVersion.ID,
670+
})
671+
require.NoError(t, err)
672+
673+
// Update the workspace
674+
inv, root = clitest.New(t, "update", "my-workspace")
675+
clitest.SetupConfig(t, client, root)
676+
doneChan := make(chan struct{})
677+
pty := ptytest.New(t).Attach(inv)
678+
go func() {
679+
defer close(doneChan)
680+
err := inv.Run()
681+
assert.NoError(t, err)
682+
}()
683+
684+
matches := []string{
685+
immutableParameterName, "thi",
686+
"Planning workspace...", "",
687+
}
688+
for i := 0; i < len(matches); i += 2 {
689+
match := matches[i]
690+
value := matches[i+1]
691+
pty.ExpectMatch(match)
692+
693+
if value != "" {
694+
pty.WriteLine(value)
695+
}
696+
}
697+
<-doneChan
698+
})
568699
}

‎coderd/apidoc/docs.go

Lines changed: 3 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/apidoc/swagger.json

Lines changed: 3 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/batchstats/batcher.go

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,8 @@ func New(ctx context.Context, opts ...Option) (*Batcher, func(), error) {
105105
b.tickCh = b.ticker.C
106106
}
107107

108+
b.initBuf(b.batchSize)
109+
108110
cancelCtx, cancelFunc := context.WithCancel(ctx)
109111
done := make(chan struct{})
110112
go func() {
@@ -172,7 +174,6 @@ func (b *Batcher) Add(
172174

173175
// Run runs the batcher.
174176
func (b *Batcher) run(ctx context.Context) {
175-
b.initBuf(b.batchSize)
176177
// nolint:gocritic // This is only ever used for one thing - inserting agent stats.
177178
authCtx := dbauthz.AsSystemRestricted(ctx)
178179
for {
@@ -184,7 +185,13 @@ func (b *Batcher) run(ctx context.Context) {
184185
b.flush(authCtx, true, "reaching capacity")
185186
case <-ctx.Done():
186187
b.log.Debug(ctx, "context done, flushing before exit")
187-
b.flush(authCtx, true, "exit")
188+
189+
// We must create a new context here as the parent context is done.
190+
ctxTimeout, cancel := context.WithTimeout(context.Background(), 15*time.Second)
191+
defer cancel() //nolint:revive // We're returning, defer is fine.
192+
193+
// nolint:gocritic // This is only ever used for one thing - inserting agent stats.
194+
b.flush(dbauthz.AsSystemRestricted(ctxTimeout), true, "exit")
188195
return
189196
}
190197
}

‎coderd/batchstats/batcher_internal_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ func TestBatchStats(t *testing.T) {
3131
deps1 := setupDeps(t, store)
3232
deps2 := setupDeps(t, store)
3333
tick := make(chan time.Time)
34-
flushed := make(chan int)
34+
flushed := make(chan int, 1)
3535

3636
b, closer, err := New(ctx,
3737
WithStore(store),

‎coderd/coderd.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -404,7 +404,7 @@ func New(options *Options) *API {
404404
api.agentProvider, err = NewServerTailnet(api.ctx,
405405
options.Logger,
406406
options.DERPServer,
407-
options.BaseDERPMap,
407+
api.DERPMap,
408408
func(context.Context) (tailnet.MultiAgentConn, error) {
409409
return (*api.TailnetCoordinator.Load()).ServeMultiAgent(uuid.New()), nil
410410
},

0 commit comments

Comments
 (0)