gorules package - github.com/coder/coder/scripts - Go Packages

Why Go
- Case Studies
  
  Common problems companies solve with Go
- Use Cases
  
  Stories about how and why companies use Go
- Security
  
  How Go can help keep you secure by default
Learn
Docs
- Effective Go
  
  Tips for writing clear, performant, and idiomatic Go code
- Go User Manual
  
  A complete introduction to building software with Go
- Standard library
  
  Reference documentation for Go's standard library
- Release Notes
  
  Learn what's new in each Go release
- API
  
  Reference documentation for the pkg.go.dev API
Packages
Community
- Recorded Talks
  
  Videos from prior events
- Meetups
  
  Meet other local Go developers
- Conferences
  
  Learn and network with Go developers from around the world
- Go blog
  
  The Go project's official blog.
- Go project
  
  Get help and stay informed from Go
- Get connected

Why Go
Why Go
Learn
Docs
Docs
Packages
Community
Community
- Recorded Talks
- Meetups
- Conferences
- Go blog
- Go project
- Get connected

Affected by GO-2024-3228 and 24 other vulnerabilities

GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

GO-2025-3938: Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder

GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

GO-2026-5911: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder

GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

GO-2026-5920: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration in github.com/coder/coder

GO-2026-5921: Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints in github.com/coder/coder

GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

GO-2026-5923: Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

GO-2026-5925: Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

The highest tagged major version is v2.

gorules

package

v0.27.3 Latest Latest

This package is not in the latest version of its module.

Go to latest Published: Aug 1, 2023 License: AGPL-3.0 Imports: 2 Imported by: 0

Main Versions Licenses Imports Imported By

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/coder/coder

Documentation ¶

Overview ¶

Package gorules defines custom lint rules for ruleguard.

golangci-lint runs these rules via go-critic, which includes support for ruleguard. All Go files in this directory define lint rules in the Ruleguard DSL; see:

- https://go-ruleguard.github.io/by-example/ - https://pkg.go.dev/github.com/quasilyte/go-ruleguard/dsl

You run one of the following commands to execute your go rules only:

golangci-lint run golangci-lint run --disable-all --enable=gocritic

Note: don't forget to run `golangci-lint cache clean`!

Index ¶

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

func FullResponseWriter ¶ added in v0.9.1

func FullResponseWriter(m dsl.Matcher)

FullResponseWriter ensures that any overridden response writer has full functionality. Mainly is hijackable and flushable.

func HttpAPIErrorMessage ¶ added in v0.6.3

func HttpAPIErrorMessage(m dsl.Matcher)

HttpAPIErrorMessage intends to enforce constructing proper sentences as error messages for the api. A proper sentence includes proper capitalization and ends with punctuation. There are ways around the linter, but this should work in the common cases.

func HttpAPIReturn ¶ added in v0.7.7

func HttpAPIReturn(m dsl.Matcher)

HttpAPIReturn will report a linter violation if the http function is not returned after writing a response to the client.

func InTx ¶

func InTx(m dsl.Matcher)

InTx checks to ensure the database used inside the transaction closure is the transaction database, and not the original database that creates the tx.

func ProperRBACReturn ¶ added in v0.7.0

func ProperRBACReturn(m dsl.Matcher)

ProperRBACReturn ensures we always write to the response writer after a call to Authorize. If we just do a return, the client will get a status code 200, which is incorrect.

Types ¶

This section is empty.

Source Files ¶

View all Source files

rules.go

Directories ¶

Show internal Expand all

Path Synopsis

apidocgen
postprocess command
apitypings
auditdocgen
audittypegen
ci-report
clidocgen
dbgen
metricsdocgen
migrate-ci
rbacgen

go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.

Okay

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL

gorules

Details

Repository

Links

Documentation ¶

Overview ¶

Index ¶

Constants ¶

Variables ¶

Functions ¶

func FullResponseWriter ¶ added in v0.9.1

func HttpAPIErrorMessage ¶ added in v0.6.3

func HttpAPIReturn ¶ added in v0.7.7

func InTx ¶

func ProperRBACReturn ¶ added in v0.7.0

Types ¶

Source Files ¶

Directories ¶

Jump to

Keyboard shortcuts