OCram85/code-server
Archived
1
0
Fork 0
Code Pull Requests 2 Activity
2,734 Commits 15 Branches 149 Tags 97 MiB
22a22a8f7a
Commit Graph

460 Commits

Author SHA1 Message Date
Joe Previte
22a22a8f7a
fix: escape error.message on login failure 2021-07-01 10:43:37 -07:00
Joe Previte
c505fc45a8
feat: add escapeHtml function 
This can be used to escape any special characters in a string with HTML before
sending from the server back to the client. This is important to prevent a
cross-site scripting attack.
 2021-07-01 10:43:36 -07:00
Joe Previte
7f12fab3ca
fix(isHashMatch): check that hash starts with $ 
Previously, we used argon2 to verify the hash with the password.

If the hash didn't start with a $, then it would enter the catch block.

Now we check the hash before trying to verify it and we also throw an Error if
the verify fails.

This makes the isHashMatch function more robust.
 2021-06-30 15:00:21 -07:00
Asher
49c44818d9
Move onLine to utilities 
This way it can be used by the tests when spawning code-server on a
random port to look for the address.
 2021-06-29 12:04:31 -05:00
Asher
b59b3936d0
Fix incorrect logout base (#3611) 
Fixes #3608.
 2021-06-15 15:11:01 -05:00
Max Schmitt
dbb34ad710 chore: upgrade to Playwright 1.12 with its new test-runner 2021-06-10 15:09:38 +02:00
Joe Previte
1e55a648a5
feat: check for empty str in isHashMatch 2021-06-08 15:10:59 -07:00
Joe Previte
3b50bfc17d
fix: sanitize password and cookie key 2021-06-08 14:33:17 -07:00
Joe Previte
8c2bb61af9
refactor: parse options with multiple = in cli 
There was a case with the hashed-password which had multiple equal signs in the
value and it wasn't being parsed correctly. This uses a new function and adds a
few tests.
 2021-06-08 14:33:17 -07:00
Joe Previte
531b7c0c25
feat: add splitOnFirstEquals function 2021-06-08 14:33:16 -07:00
Joe Previte
517aaf71c5
docs: update FAQ with new hashing instructions 2021-06-08 14:33:16 -07:00
Joe Previte
923761cd78
refactor: password logic in http w/ isCookieValid 2021-06-08 14:33:16 -07:00
Joe Previte
6020480b30
feat: add isCookieValid function and tests 2021-06-08 14:33:16 -07:00
Joe Previte
409b473c82
refactor: rewrite password logic at /login 2021-06-08 14:33:15 -07:00
Joe Previte
a14ea39c4a
feat: add handlePasswordValidation + tests 2021-06-08 14:33:15 -07:00
Joe Previte
7ff4117531
feat: add getPasswordMethod & test for it 2021-06-08 14:33:15 -07:00
Joe Previte
ffa5c16e51
feat: update cli and test for hashed-password 2021-06-08 14:33:15 -07:00
Joe Previte
1134780b8b
refactor: make wsProxy async 2021-06-08 14:33:14 -07:00
Joe Previte
91303d4e40
refactor: make ensureAuthenticated async 2021-06-08 14:33:14 -07:00
Joe Previte
0cdbd33b46
refactor: make authenticated async everywhere 
Since this checks if they are authenticated using the hash/password and it's
async, we need to update authenticated to be async, which means we have to
update it everywhere it's used.
 2021-06-08 14:33:14 -07:00
Joe Previte
fcc3f0d951
refactor: update login logic with new async hashing 
This adds the proper await logic for the hashing of passwords.
 2021-06-08 14:33:13 -07:00
Joe Previte
70197bb2a5
refactor: use argon2 instead of bcrypt 
This uses argon2 instead of bcrypt.

Note: this means the hash functions are now async which means we have to
refactor a lot of other code around auth.
 2021-06-08 14:33:13 -07:00
Joe Previte
aaf044728f
refactor: add functions to check hash password 2021-06-08 14:33:12 -07:00
Joe Previte
cac667317e
refactor: use bcrypt in hash function 2021-06-08 14:33:11 -07:00
Joe Previte
46fe77d464
chore: update CHANGELOG 2021-05-13 12:10:22 -07:00
Joe Previte
d7f1415290
refactor: use paths.runtime in socket proxyPipe 2021-05-13 12:10:21 -07:00
Joe Previte
a57ee69822
feat: add runtime to getEnvPaths 2021-05-13 12:10:21 -07:00
Asher
a882be5748
Refactor integration tests to use main entry point 2021-05-05 12:24:41 -05:00
Asher
20e70cfa05
Remove try from main 
All it does is log and exit which is what the caller will be doing on an
error anyway (see entry).
 2021-05-05 12:24:36 -05:00
Asher
c96fb65308
Split some entry methods into main 
This is so they can be unit tested.
 2021-05-05 12:24:35 -05:00
Asher
083400b50a
Add flag to enable permessage-deflate 2021-05-05 12:24:34 -05:00
Asher
92bf2c9760
Add dev mode constant 2021-05-05 10:16:01 -05:00
Asher
a48ac5080b
Share common util code with VS Code 
This lets us re-use the normalized base path so when we expire/clear the
cookie we use the same base path.
 2021-05-04 13:29:40 -05:00
Asher
49c26f70f7
Add logout route 2021-05-04 13:29:39 -05:00
Asher
e7a527514a
Add authed context key 2021-05-03 15:00:54 -05:00
Joe Previte
cb65590b98
refactor: move tmpdir into src/node/constants 2021-04-23 14:35:32 -07:00
Asher
b9c80b8520
Merge pull request #3178 from code-asher/connections 
Minor connections refactor
 2021-04-21 12:22:45 -05:00
Asher
f0bafa387f
Move connection logic into connection class 
- Moved everything I could into the class itself.
- Improve the logging situation a bit.
- Switch some trace logs to debug.
- Get debug port from message arguments.
 2021-04-21 11:48:45 -05:00
Joe Previte
f80d5c3764
refactor: rateLimiter.canTry logic to check >= 1 2021-04-19 13:14:19 -07:00
Joe Previte
7a5042176e
fix: update logic for removing token from limiter 2021-04-19 11:12:43 -07:00
Joe Previte
a3f18d6158
refactor: change limiter.Try() to .removeToken() 2021-04-19 10:57:50 -07:00
Joe Previte
d8e45057c7
refactor: update rateLimiter to check try 
This changes adds a new method called `.canTry` to the rate limiter to check if
there are tokens remaining in the bucket.

It also adds suggestions from @oxy to make sure the user can brute force past
the rate limiter.
 2021-04-19 10:40:59 -07:00
Joe Previte
08521077f0
refactor(login): move rate limiter after successful login 
Before, we weren't checking if a login was successful before counting it
against the rate limiter.

With this change, we only count unsuccessful logins against the rate limiter.

We did this because this was a bug but also because it caused problems with our
e2e tests hitting the rate limit.
 2021-04-19 10:40:59 -07:00
Joe Previte
4683d8a077
fix: update comment and export rateLimiter 2021-04-19 10:40:58 -07:00
Asher
101c2a01f1
Fix tsc watch restarting when it shouldn't 
It seems reaching into lib/vscode for the types caused tsc to establish
watches that caused it to restart over and over while vscode was
building.

The strategy used here is to symlink it instead which is the same thing
we do for the proxy agent.
 2021-04-01 10:58:56 -05:00
Joe Previte
df6bfbbeaf
feat: bump ts-node to 9.1.1 2021-03-30 16:46:49 -07:00
Joe Previte
e4db80667e
refactor: use stdio correctly in wrapper 2021-03-29 14:05:59 -07:00
Asher
18ace7b906
Don't send permessage-deflate header if not supported (#2993) 2021-03-29 12:59:36 -05:00
Joe Previte
b04104cafe
Merge branch 'main' into jsjoeio/upgrade-vscode-1.54 2021-03-22 10:43:39 -07:00
dependabot[bot]
a8e2ede4f5
chore(deps): bump js-yaml from 3.14.0 to 4.0.0 (#2920) 
* chore(deps): bump js-yaml from 3.14.0 to 4.0.0

Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 3.14.0 to 4.0.0.
- [Release notes](https://github.com/nodeca/js-yaml/releases)
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/compare/3.14.0...4.0.0)

Signed-off-by: dependabot[bot] <support@github.com>

* fix(src/node): replace yaml.safeLoad with load

Also update @types/yaml to ^4.0.0.

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Akash Satheesan <akash@coder.com>
 2021-03-18 16:30:10 -05:00