Function ValidateSSHConfigOption

codersdk/deployment.go:785–816

ValidateSSHConfigOption validates one deployment SSH option before it is written to users' local SSH configs.

(key, value string)

// ValidateSSHConfigOption validates one deployment SSH option before it is
// written to users' local SSH configs.
func ValidateSSHConfigOption(key, value string) error {
	if key == "" {
		return xerrors.New("ssh config option key must not be empty")
	}
	if strings.ContainsAny(key, "=\r\n\x00") || strings.ContainsFunc(key, unicode.IsSpace) {
		return xerrors.Errorf("ssh config option key %q is invalid", key)
	}
	// These options are rejected because, written into a user's SSH config by a
	// deployment, they can execute code, load shared libraries, or override
	// Coder's managed SSH settings on the client machine. When extending this
	// list, classify the directive against these categories; the newline and
	// whitespace checks above already prevent multi-line injection, so only
	// single-line dangerous directives belong here.
	switch strings.ToLower(key) {
	// Structural directives that escape Coder's managed block.
	case "host", "match", "include",
		// Directives that run an attacker-supplied command string.
		"proxycommand", "localcommand", "permitlocalcommand", "remotecommand", "knownhostscommand",
		// Directives that dlopen an attacker-controlled shared library.
		"pkcs11provider", "securitykeyprovider", "smartcarddevice",
		// Directives that execute a command for X11 authentication.
		"xauthlocation":
		return xerrors.Errorf("ssh config option %q is not allowed: it can execute code, load shared libraries, or override Coder's managed SSH settings on client machines", key)
	// ProxyJump conflicts with Coder's managed ProxyCommand.
	case "proxyjump":
		return xerrors.Errorf("ssh config option %q is not allowed: it conflicts with Coder's managed ProxyCommand", key)
	}
	if strings.ContainsAny(value, "\r\n\x00") {
		return xerrors.Errorf("ssh config option %q must not contain carriage return, newline, or NUL characters", key)
	}
	return nil
}

// SessionLifetime refers to "sessions" authenticating into Coderd. Coder has
// multiple different session types: api keys, tokens, workspace app tokens,