fix(coderd): reject workspace proxy hostname prefixes (#27544) (#27616)

github-actions[bot] · geokat · BobbyHo · web-flow · commit d547bea24a75 · 2026-07-28T14:07:02.000-07:00
Backport of #27544 Original PR: #27544 — fix(coderd): reject workspace proxy hostname prefixes Merge commit: 8cc7f2b Requested by: @geokat Co-authored-by: George K <george@coder.com> Co-authored-by: Bobby Ho <bobbidinho@gmail.com>
diff --git a/coderd/database/querier_test.go b/coderd/database/querier_test.go
@@ -1841,6 +1841,16 @@ func TestProxyByHostname(t *testing.T) {
 			accessURL:        "https://two.coder.com",
 			wildcardHostname: "*--suffix.two.coder.com",
 		},
+		{
+			name:             "three",
+			accessURL:        "https://three.coder.com:8443",
+			wildcardHostname: "*.wildcard.three.coder.com",
+		},
+		{
+			name:             "four",
+			accessURL:        "https://four.coder.com/",
+			wildcardHostname: "*.wildcard.four.coder.com",
+		},
 	}
 	for _, p := range proxies {
 		dbgen.WorkspaceProxy(t, db, database.WorkspaceProxy{
@@ -1871,20 +1881,62 @@ func TestProxyByHostname(t *testing.T) {
 			allowWildcardHost: true,
 			matchProxyName:    "one",
 		},
+		{
+			name:              "MatchAccessURLWithPort",
+			testHostname:      "three.coder.com",
+			allowAccessURL:    true,
+			allowWildcardHost: false,
+			matchProxyName:    "three",
+		},
+		{
+			name:              "MatchAccessURLWithTrailingSlash",
+			testHostname:      "four.coder.com",
+			allowAccessURL:    true,
+			allowWildcardHost: false,
+			matchProxyName:    "four",
+		},
+		{
+			name:              "RejectAccessURLPrefix",
+			testHostname:      "one.coder",
+			allowAccessURL:    true,
+			allowWildcardHost: false,
+			matchProxyName:    "",
+		},
+		{
+			name:              "RejectAccessURLTLDPrefix",
+			testHostname:      "one.coder.co",
+			allowAccessURL:    true,
+			allowWildcardHost: false,
+			matchProxyName:    "",
+		},
 		{
 			name:              "MatchWildcard",
 			testHostname:      "something.wildcard.one.coder.com",
 			allowAccessURL:    true,
 			allowWildcardHost: true,
 			matchProxyName:    "one",
 		},
+		{
+			name:              "RejectWildcardHostnamePrefix",
+			testHostname:      "something.wildcard.one.coder",
+			allowAccessURL:    false,
+			allowWildcardHost: true,
+			matchProxyName:    "",
+		},
 		{
 			name:              "MatchSuffix",
 			testHostname:      "something--suffix.two.coder.com",
 			allowAccessURL:    true,
 			allowWildcardHost: true,
 			matchProxyName:    "two",
 		},
+		{
+			name:              "RejectSuffixHostnamePrefix",
+			testHostname:      "something--suffix.two.coder",
+			allowAccessURL:    false,
+			allowWildcardHost: true,
+			matchProxyName:    "",
+		},
 		{
 			name:              "ValidateHostname/1",
 			testHostname:      ".*ne.coder.com",
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
diff --git a/coderd/database/queries/proxies.sql b/coderd/database/queries/proxies.sql
@@ -120,7 +120,7 @@ WHERE
 	(
 		(
 			@allow_access_url :: bool = true AND
-			url SIMILAR TO '[^:]*://' || @hostname :: text || '([:/]?%)*'
+			url SIMILAR TO '[^:]*://' || @hostname :: text || '([:/]%)*'
 		) OR
 		(
 			@allow_wildcard_hostname :: bool = true AND
diff --git a/coderd/workspaceapps_test.go b/coderd/workspaceapps_test.go
@@ -115,6 +115,15 @@ func TestWorkspaceApplicationAuth(t *testing.T) {
 			redirectURI:      "https://proxy.test.coder.com/path",
 			expectRedirect:   "https://proxy.test.coder.com/path",
 		},
+		{
+			name:             "RejectProxyAccessURLPrefix",
+			accessURL:        "https://test.coder.com",
+			appHostname:      "*.test.coder.com",
+			proxyURL:         "https://proxy.test.coder.com",
+			proxyAppHostname: "*.proxy.test.coder.com",
+			redirectURI:      "https://proxy.test.coder/path",
+			expectRedirect:   "",
+		},
 		{
 			name:             "ProxySubdomainOK",
 			accessURL:        "https://test.coder.com",

Original file line number	Diff line number	Diff line change
`@@ -120,7 +120,7 @@ WHERE`
`120`	`120`	`(`
`121`	`121`	`(`
`122`	`122`	`@allow_access_url :: bool = true AND`
`123`		`- url SIMILAR TO '[^:]://' \|\| @hostname :: text \|\| '([:/]?%)'`
	`123`	`+ url SIMILAR TO '[^:]://' \|\| @hostname :: text \|\| '([:/]%)'`
`124`	`124`	`) OR`
`125`	`125`	`(`
`126`	`126`	`@allow_wildcard_hostname :: bool = true AND`