opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(coderd): enforce ActionSSH in MCP HTTP agent connection path (#24607)

Browse Source
This commit is contained in:
Jakub Domeracki
2026-04-22 12:34:17 +02:00
committed by GitHub
parent cc4e04afde
commit 86b2db60b2
2 changed files with 121 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
coderd/mcp_http.go
+34 -1
View File
@@ -1,15 +1,22 @@
package coderd
import (
"context"
"fmt"
"net/http"
"github.com/google/uuid"
"golang.org/x/xerrors"
"cdr.dev/slog/v3"
"github.com/coder/coder/v2/coderd/database/dbauthz"
"github.com/coder/coder/v2/coderd/httpapi"
"github.com/coder/coder/v2/coderd/httpmw"
"github.com/coder/coder/v2/coderd/mcp"
"github.com/coder/coder/v2/coderd/rbac/policy"
"github.com/coder/coder/v2/codersdk"
"github.com/coder/coder/v2/codersdk/toolsdk"
"github.com/coder/coder/v2/codersdk/workspacesdk"
)
type MCPToolset string
@@ -35,7 +42,33 @@ func (api *API) mcpHTTPHandler() http.Handler {
// Extract the original session token from the request
authenticatedClient := codersdk.New(api.AccessURL,
codersdk.WithSessionToken(httpmw.APITokenFromRequest(r)))
toolOpt := toolsdk.WithAgentConnFunc(api.agentProvider.AgentConn)
// Wrap the agent connection function to enforce ActionSSH
// on the workspace. Without this check, a user who can read
// a workspace but lacks SSH permission could still execute
// commands through MCP tools.
toolOpt := toolsdk.WithAgentConnFunc(func(ctx context.Context, agentID uuid.UUID) (workspacesdk.AgentConn, func(), error) {
if api.Entitlements.Enabled(codersdk.FeatureBrowserOnly) {
return nil, nil, xerrors.New("non-browser connections are disabled")
}
// Use system context for the lookup because the tool
// handler context does not carry a dbauthz actor. The
// real authorization happens in the Authorize call below.
//nolint:gocritic // The system query only fetches the workspace
// object so we can perform an ActionSSH check against it
// with the real user's roles via api.Authorize.
workspace, err := api.Database.GetWorkspaceByAgentID(dbauthz.AsSystemRestricted(ctx), agentID)
if err != nil {
return nil, nil, xerrors.Errorf("get workspace by agent ID: %w", err)
}
// Enforce the same ActionSSH check that the coordinate
// endpoint uses (workspaceagents.go:1317).
if !api.Authorize(r, policy.ActionSSH, workspace) {
return nil, nil, xerrors.New("unauthorized: you do not have SSH access to this workspace")
}
return api.agentProvider.AgentConn(ctx, agentID)
})
toolset := MCPToolset(r.URL.Query().Get("toolset"))
// Default to standard toolset if no toolset is specified.
if toolset == "" {