newrelic_rpm 3.12.0.288 → 9.10.2

data/lib/new_relic/agent/attribute_pre_filtering.rb

@@ -0,0 +1,109 @@
+# This file is distributed under New Relic's license terms.
+# See https://github.com/newrelic/newrelic-ruby-agent/blob/main/LICENSE for complete details.
+# frozen_string_literal: true
+
+module NewRelic
+  module Agent
+    module AttributePreFiltering
+      module_function
+
+      PRE_FILTER_KEYS = %i[include exclude].freeze
+      DISCARDED = :nr_discarded
+
+      def formulate_regexp_union(option)
+        return if NewRelic::Agent.config[option].empty?
+
+        Regexp.union(NewRelic::Agent.config[option].map { |p| string_to_regexp(p) }.uniq.compact).freeze
+      rescue StandardError => e
+        NewRelic::Agent.logger.warn("Failed to formulate a Regexp union from the '#{option}' configuration option " +
+                                    "- #{e.class}: #{e.message}")
+      end
+
+      def string_to_regexp(str)
+        Regexp.new(str)
+      rescue StandardError => e
+        NewRelic::Agent.logger.warn("Failed to initialize Regexp from string '#{str}' - #{e.class}: #{e.message}")
+      end
+
+      # attribute filtering suppresses data that has already been flattened
+      # and coerced (serialized as text) via #flatten_and_coerce, and is
+      # restricted to basic text matching with a single optional wildcard.
+      # pre filtering operates on raw Ruby objects beforehand and uses full
+      # Ruby regex syntax
+      def pre_filter(values = [], options = {})
+        return values unless !options.empty? && PRE_FILTER_KEYS.any? { |k| options.key?(k) }
+
+        # if there's a prefix in play for (non-pre) attribute filtration and
+        # attribute filtration won't allow that prefix, then don't even bother
+        # with pre filtration that could only result in values that would be
+        # blocked
+        if options.key?(:attribute_namespace) &&
+            !NewRelic::Agent.instance.attribute_filter.might_allow_prefix?(options[:attribute_namespace])
+          return values
+        end
+
+        values.each_with_object([]) do |element, filtered|
+          object = pre_filter_object(element, options)
+          filtered << object unless discarded?(object)
+        end
+      end
+
+      def pre_filter_object(object, options)
+        if object.is_a?(Hash)
+          pre_filter_hash(object, options)
+        elsif object.is_a?(Array)
+          pre_filter_array(object, options)
+        else
+          pre_filter_scalar(object, options)
+        end
+      end
+
+      def pre_filter_hash(hash, options)
+        filtered_hash = hash.each_with_object({}) do |(key, value), filtered|
+          filtered_key = pre_filter_object(key, options)
+          next if discarded?(filtered_key)
+
+          # If the key is permitted, skip include filtration for the value
+          # but still apply exclude filtration
+          if options.key?(:exclude)
+            exclude_only = options.dup
+            exclude_only.delete(:include)
+            filtered_value = pre_filter_object(value, exclude_only)
+            next if discarded?(filtered_value)
+          else
+            filtered_value = value
+          end
+
+          filtered[filtered_key] = filtered_value
+        end
+
+        filtered_hash.empty? && !hash.empty? ? DISCARDED : filtered_hash
+      end
+
+      def pre_filter_array(array, options)
+        filtered_array = array.each_with_object([]) do |element, filtered|
+          filtered_element = pre_filter_object(element, options)
+          next if discarded?(filtered_element)
+
+          filtered.push(filtered_element)
+        end
+
+        filtered_array.empty? && !array.empty? ? DISCARDED : filtered_array
+      end
+
+      def pre_filter_scalar(scalar, options)
+        return DISCARDED if options.key?(:include) && !scalar.to_s.match?(options[:include])
+        return DISCARDED if options.key?(:exclude) && scalar.to_s.match?(options[:exclude])
+
+        scalar
+      end
+
+      # `nil`, empty enumerable objects, and `false` are all valid in their
+      # own right as application data, so pre-filtering uses a special value
+      # to indicate that filtered out data has been discarded
+      def discarded?(object)
+        object == DISCARDED
+      end
+    end
+  end
+end

data/lib/new_relic/agent/attribute_processing.rb

@@ -1,29 +1,29 @@
-# encoding: utf-8
 # This file is distributed under New Relic's license terms.
-# See https://github.com/newrelic/rpm/blob/master/LICENSE for complete details.
+# See https://github.com/newrelic/newrelic-ruby-agent/blob/main/LICENSE for complete details.
+# frozen_string_literal: true
 
 module NewRelic
   module Agent
     module AttributeProcessing
       module_function
 
-      EMPTY_HASH_STRING_LITERAL = "{}".freeze
-      EMPTY_ARRAY_STRING_LITERAL = "[]".freeze
+      EMPTY_HASH_STRING_LITERAL = '{}'.freeze
+      EMPTY_ARRAY_STRING_LITERAL = '[]'.freeze
 
       def flatten_and_coerce(object, prefix = nil, result = {}, &blk)
-        if object.is_a? Hash
+        if object.is_a?(Hash)
           flatten_and_coerce_hash(object, prefix, result, &blk)
-        elsif object.is_a? Array
+        elsif object.is_a?(Array)
           flatten_and_coerce_array(object, prefix, result, &blk)
         elsif prefix
           val = Coerce.scalar(object)
           if blk
-            blk.call(prefix, val)
-          else
+            yield(prefix, val)
+          elsif !val.nil?
             result[prefix] = val
           end
         else
-          NewRelic::Agent.logger.warn "Unexpected object: #{object.inspect} with nil prefix passed to NewRelic::Agent::AttributeProcessing.flatten_and_coerce"
+          NewRelic::Agent.logger.warn("Unexpected object: #{object.inspect} with nil prefix passed to NewRelic::Agent::AttributeProcessing.flatten_and_coerce")
         end
         result
       end
@@ -31,7 +31,7 @@ module NewRelic
       def flatten_and_coerce_hash(hash, prefix, result, &blk)
         if hash.empty?
           if blk
-            blk.call(prefix, EMPTY_HASH_STRING_LITERAL)
+            yield(prefix, EMPTY_HASH_STRING_LITERAL)
           else
             result[prefix] = EMPTY_HASH_STRING_LITERAL
           end
@@ -46,7 +46,7 @@ module NewRelic
       def flatten_and_coerce_array(array, prefix, result, &blk)
         if array.empty?
           if blk
-            blk.call(prefix, EMPTY_ARRAY_STRING_LITERAL)
+            yield(prefix, EMPTY_ARRAY_STRING_LITERAL)
           else
             result[prefix] = EMPTY_ARRAY_STRING_LITERAL
           end
@@ -59,4 +59,4 @@ module NewRelic
       end
     end
   end
-end
+end

data/lib/new_relic/agent/attributes.rb

@@ -0,0 +1,153 @@
+# This file is distributed under New Relic's license terms.
+# See https://github.com/newrelic/newrelic-ruby-agent/blob/main/LICENSE for complete details.
+# frozen_string_literal: true
+
+require 'new_relic/agent/attribute_processing'
+
+module NewRelic
+  module Agent
+    class Attributes
+      KEY_LIMIT = 255
+      VALUE_LIMIT = 255
+      COUNT_LIMIT = 64
+
+      attr_reader :custom_attributes
+
+      def initialize(filter)
+        @filter = filter
+
+        @custom_attributes = {}
+        @agent_attributes = {}
+        @intrinsic_attributes = {}
+
+        @custom_destinations = {}
+        @agent_destinations = {}
+        @already_warned_count_limit = nil
+      end
+
+      def add_agent_attribute(key, value, default_destinations)
+        destinations = @filter.apply(key, default_destinations)
+        return if destinations == AttributeFilter::DST_NONE
+
+        @agent_destinations[key] = destinations
+        add(@agent_attributes, key, value)
+      end
+
+      def add_agent_attribute_with_key_check(key, value, default_destinations)
+        if exceeds_bytesize_limit?(key, KEY_LIMIT)
+          NewRelic::Agent.logger.debug("Agent attribute #{key} was dropped for exceeding key length limit #{KEY_LIMIT}")
+          return
+        end
+
+        add_agent_attribute(key, value, default_destinations)
+      end
+
+      def add_intrinsic_attribute(key, value)
+        add(@intrinsic_attributes, key, value)
+      end
+
+      def merge_untrusted_agent_attributes(attributes, prefix, default_destinations)
+        return if @filter.high_security?
+        return if !@filter.might_allow_prefix?(prefix)
+
+        AttributeProcessing.flatten_and_coerce(attributes, prefix) do |k, v|
+          add_agent_attribute_with_key_check(k, v, AttributeFilter::DST_NONE)
+        end
+      end
+
+      def merge_custom_attributes(other)
+        return unless Agent.config[:'custom_attributes.enabled']
+        return if other.empty?
+
+        AttributeProcessing.flatten_and_coerce(other) do |k, v|
+          add_custom_attribute(k, v)
+        end
+      end
+
+      def custom_attributes_for(destination)
+        for_destination(@custom_attributes, @custom_destinations, destination)
+      end
+
+      def agent_attributes_for(destination)
+        for_destination(@agent_attributes, @agent_destinations, destination)
+      end
+
+      def intrinsic_attributes_for(destination)
+        if destination == NewRelic::Agent::AttributeFilter::DST_TRANSACTION_TRACER ||
+            destination == NewRelic::Agent::AttributeFilter::DST_ERROR_COLLECTOR
+          @intrinsic_attributes
+        else
+          NewRelic::EMPTY_HASH
+        end
+      end
+
+      private
+
+      def add_custom_attribute(key, value)
+        if @custom_attributes.size >= COUNT_LIMIT
+          unless @already_warned_count_limit
+            NewRelic::Agent.logger.warn("Custom attributes count exceeded limit of #{COUNT_LIMIT}. Any additional custom attributes during this transaction will be dropped.")
+            @already_warned_count_limit = true
+          end
+          return
+        end
+
+        if @filter.high_security?
+          NewRelic::Agent.logger.debug("Unable to add custom attribute #{key} while in high security mode.")
+          return
+        end
+
+        if exceeds_bytesize_limit?(key, KEY_LIMIT)
+          NewRelic::Agent.logger.warn("Custom attribute key '#{key}' was longer than limit of #{KEY_LIMIT} bytes. This attribute will be dropped.")
+          return
+        end
+
+        destinations = @filter.apply(key, AttributeFilter::DST_ALL)
+        return if destinations == AttributeFilter::DST_NONE
+
+        @custom_destinations[key] = destinations
+        add(@custom_attributes, key, value)
+      end
+
+      def add(attributes, key, value)
+        return if value.nil?
+
+        if exceeds_bytesize_limit?(value, VALUE_LIMIT)
+          value = slice(value)
+        end
+
+        attributes[key] = value
+      end
+
+      def for_destination(attributes, calculated_destinations, destination)
+        # Avoid allocating anything if there are no attrs at all
+        return NewRelic::EMPTY_HASH if attributes.empty?
+
+        attributes.inject({}) do |memo, (key, value)|
+          if @filter.allows?(calculated_destinations[key], destination)
+            memo[key] = value
+          end
+          memo
+        end
+      end
+
+      def exceeds_bytesize_limit?(value, limit)
+        if value.respond_to?(:bytesize)
+          value.bytesize > limit
+        elsif value.is_a?(Symbol)
+          value.to_s.bytesize > limit
+        else
+          false
+        end
+      end
+
+      # Take one byte past our limit. Why? This lets us unconditionally chop!
+      # the end. It'll either remove the one-character-too-many we have, or
+      # peel off the partial, mangled character left by the byteslice.
+      def slice(incoming)
+        result = incoming.to_s.byteslice(0, VALUE_LIMIT + 1)
+        result.chop!
+      end
+    end
+  end
+end

data/lib/new_relic/agent/audit_logger.rb

@@ -1,10 +1,11 @@
-# encoding: utf-8
 # This file is distributed under New Relic's license terms.
-# See https://github.com/newrelic/rpm/blob/master/LICENSE for complete details.
+# See https://github.com/newrelic/newrelic-ruby-agent/blob/main/LICENSE for complete details.
+# frozen_string_literal: true
 
 require 'logger'
 require 'fileutils'
 require 'new_relic/agent/hostname'
+require 'new_relic/agent/instrumentation/logger/instrumentation'
 
 module NewRelic
   module Agent
@@ -13,6 +14,7 @@ module NewRelic
         @enabled = NewRelic::Agent.config[:'audit_log.enabled']
         @endpoints = NewRelic::Agent.config[:'audit_log.endpoints']
         @encoder = NewRelic::Agent::NewRelicService::Encoders::Identity
+        @log = nil
       end
 
       attr_writer :enabled
@@ -25,6 +27,17 @@ module NewRelic
         !@log.nil?
       end
 
+      def log_request_headers(uri, headers)
+        return unless enabled? && allowed_endpoint?(uri)
+
+        @log.info("REQUEST HEADERS: #{headers}")
+      rescue StandardError, SystemStackError, SystemCallError => e
+        ::NewRelic::Agent.logger.warn('Failed writing request headers to audit log', e)
+      rescue Exception => e
+        ::NewRelic::Agent.logger.warn('Failed writing request headers to audit log with exception. Re-raising in case of interrupt.', e)
+        raise
+      end
+
       def log_request(uri, data, marshaller)
         return unless enabled? && allowed_endpoint?(uri)
 
@@ -37,9 +50,9 @@ module NewRelic
         @log.info("REQUEST: #{uri}")
         @log.info("REQUEST BODY: #{request_body}")
       rescue StandardError, SystemStackError, SystemCallError => e
-        ::NewRelic::Agent.logger.warn("Failed writing to audit log", e)
+        ::NewRelic::Agent.logger.warn('Failed writing to audit log', e)
       rescue Exception => e
-        ::NewRelic::Agent.logger.warn("Failed writing to audit log with exception. Re-raising in case of interupt.", e)
+        ::NewRelic::Agent.logger.warn('Failed writing to audit log with exception. Re-raising in case of interrupt.', e)
         raise
       end
 
@@ -51,7 +64,7 @@ module NewRelic
         if wants_stdout?
           # Using $stdout global for easier reassignment in testing
           @log = ::Logger.new($stdout)
-          ::NewRelic::Agent.logger.info("Audit log enabled to STDOUT")
+          ::NewRelic::Agent.logger.info('Audit log enabled to STDOUT')
         elsif path = ensure_log_path
           @log = ::Logger.new(path)
           ::NewRelic::Agent.logger.info("Audit log enabled at '#{path}'")
@@ -59,6 +72,9 @@ module NewRelic
           @log = NewRelic::Agent::NullLogger.new
         end
 
+        # Never have agent log forwarding capture audits
+        NewRelic::Agent::Instrumentation::Logger.mark_skip_instrumenting(@log)
+
         @log.formatter = create_log_formatter
       end
 
@@ -79,13 +95,13 @@ module NewRelic
       end
 
       def wants_stdout?
-        ::NewRelic::Agent.config[:'audit_log.path'].upcase == "STDOUT"
+        ::NewRelic::Agent.config[:'audit_log.path'].casecmp(NewRelic::STANDARD_OUT) == 0
       end
 
       def create_log_formatter
         @hostname = NewRelic::Agent::Hostname.get
         @prefix = wants_stdout? ? '** [NewRelic]' : ''
-        Proc.new do |severity, time, progname, msg|
+        proc do |severity, time, progname, msg|
           "#{@prefix}[#{time} #{@hostname} (#{$$})] : #{msg}\n"
         end
       end

data/lib/new_relic/agent/autostart.rb

@@ -1,6 +1,6 @@
-# encoding: utf-8
 # This file is distributed under New Relic's license terms.
-# See https://github.com/newrelic/rpm/blob/master/LICENSE for complete details.
+# See https://github.com/newrelic/newrelic-ruby-agent/blob/main/LICENSE for complete details.
+# frozen_string_literal: true
 
 module NewRelic
   module Agent
@@ -8,74 +8,63 @@ module NewRelic
     # monitoring.
     #
     # If the agent is in a monitored environment (e.g. production) it will
-    # attempt to avoid starting at "inapproriate" times, for example in an IRB
+    # attempt to avoid starting at "inappropriate" times, for example in an IRB
     # session.  On Heroku, logs typically go to STDOUT so agent logs can spam
     # the console during interactive sessions.
     #
     # It should be possible to override Autostart logic with an explicit
-    # configuration, for example the NEWRELIC_AGENT_ENABLED environment variable or
+    # configuration, for example the NEW_RELIC_AGENT_ENABLED environment variable or
     # agent_enabled key in newrelic.yml
     module Autostart
       extend self
 
-
       # The constants, executables (i.e. $0) and rake tasks used can be
-      # configured with the config keys 'autostart.blacklisted_constants',
-      # 'autostart.blacklisted_executables' and
-      # 'autostart.blacklisted_rake_tasks'
+      # configured with the config keys 'autostart.denylisted_constants',
+      # 'autostart.denylisted_executables' and
+      # 'autostart.denylisted_rake_tasks'
       def agent_should_start?
-          !blacklisted_constants? &&
-          !blacklisted_executables? &&
-          !in_blacklisted_rake_task?
+        !denylisted_constants? &&
+          !denylisted_executables? &&
+          !in_denylisted_rake_task?
       end
 
-      def blacklisted_constants?
-        blacklisted?(NewRelic::Agent.config[:'autostart.blacklisted_constants']) do |name|
-          constant_is_defined?(name)
-        end
-      end
+      COMMA = ','.freeze
 
-      def blacklisted_executables?
-        blacklisted?(NewRelic::Agent.config[:'autostart.blacklisted_executables']) do |bin|
-          File.basename($0) == bin
+      def denylisted_constants?
+        denylisted?(NewRelic::Agent.config[:'autostart.denylisted_constants']) do |name|
+          if RUBY_PLATFORM.eql?('java')
+            # As of JRuby 9.3.4.0, Object.const_defined? will still cross
+            # namespaces to find constants, which is not what we want. This
+            # behavior is similar to CRuby's Object.const_get prior to v2.6.
+            #
+            # Example:
+            #  irb> class MyClass; end; module MyModule; end
+            #  irb> Object.const_defined?('MyModule::MyClass') # => true
+            !!::NewRelic::LanguageSupport.constantize(name)
+          else
+            Object.const_defined?(name)
+          end
         end
       end
 
-      # Lookup whether namespaced constants (e.g. ::Foo::Bar::Baz) are in the
-      # environment.
-      def constant_is_defined?(const_name)
-        const_name.to_s.sub(/\A::/,'').split('::').inject(Object) do |namespace, name|
-          begin
-            result = namespace.const_get(name)
-
-            # const_get looks up the inheritence chain, so if it's a class
-            # in the constant make sure we found the one in our namespace.
-            #
-            # Can't help if the constant isn't a class...
-            if result.is_a?(Module)
-              expected_name = "#{namespace}::#{name}".gsub(/^Object::/, "")
-              return false unless expected_name == result.to_s
-            end
-
-            result
-          rescue NameError
-            false
-          end
+      def denylisted_executables?
+        denylisted?(NewRelic::Agent.config[:'autostart.denylisted_executables']) do |bin|
+          File.basename($0) == bin
         end
       end
 
-      def blacklisted?(value, &block)
+      def denylisted?(value, &block)
         value.split(/\s*,\s*/).any?(&block)
       end
 
-      def in_blacklisted_rake_task?
+      def in_denylisted_rake_task?
         tasks = begin
-                  ::Rake.application.top_level_tasks
-                rescue => e
-            ::NewRelic::Agent.logger.debug("Not in Rake environment so skipping blacklisted_rake_tasks check: #{e}")
-            []
-          end
-        !(tasks & ::NewRelic::Agent.config[:'autostart.blacklisted_rake_tasks'].split(/\s*,\s*/)).empty?
+          ::Rake.application.top_level_tasks
+        rescue => e
+          ::NewRelic::Agent.logger.debug("Not in Rake environment so skipping denylisted_rake_tasks check: #{e}")
+          NewRelic::EMPTY_ARRAY
+        end
+        !(tasks & ::NewRelic::Agent.config[:'autostart.denylisted_rake_tasks'].split(/\s*,\s*/)).empty?
       end
     end
   end

data/lib/new_relic/agent/aws.rb

@@ -0,0 +1,62 @@
+# This file is distributed under New Relic's license terms.
+# See https://github.com/newrelic/newrelic-ruby-agent/blob/main/LICENSE for complete details.
+# frozen_string_literal: true
+
+module NewRelic
+  module Agent
+    module Aws
+      CHARACTERS = %w[A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 2 3 4 5 6 7].freeze
+      HEX_MASK = '7fffffffff80'
+
+      def self.create_arn(service, resource, region, account_id)
+        "arn:aws:#{service}:#{region}:#{account_id}:#{resource}"
+      rescue => e
+        NewRelic::Agent.logger.warn("Failed to create ARN: #{e}")
+      end
+
+      def self.get_account_id(config)
+        access_key_id = config.credentials.credentials.access_key_id if config&.credentials&.credentials&.respond_to?(:access_key_id)
+        return unless access_key_id
+
+        NewRelic::Agent::Aws.convert_access_key_to_account_id(access_key_id)
+      rescue => e
+        NewRelic::Agent.logger.debug("Failed to create account id: #{e}")
+      end
+
+      def self.convert_access_key_to_account_id(access_key)
+        decoded_key = Integer(decode_to_hex(access_key[4..-1]), 16)
+        mask = Integer(HEX_MASK, 16)
+        (decoded_key & mask) >> 7
+      end
+
+      def self.decode_to_hex(access_key)
+        bytes = access_key.delete('=').each_char.map { |c| CHARACTERS.index(c) }
+
+        bytes.each_slice(8).map do |section|
+          convert_section(section)
+        end.flatten[0...6].join
+      end
+
+      def self.convert_section(section)
+        buffer = 0
+        section.each do |chunk|
+          buffer = (buffer << 5) + chunk
+        end
+
+        chunk_count = (section.length * 5.0 / 8.0).floor
+
+        if section.length < 8
+          buffer >>= (5 - (chunk_count * 8)) % 5
+        end
+
+        decoded = []
+        chunk_count.times do |i|
+          shift = 8 * (chunk_count - 1 - i)
+          decoded << ((buffer >> shift) & 255).to_s(16)
+        end
+
+        decoded
+      end
+    end
+  end
+end

data/lib/new_relic/agent/chained_call.rb

@@ -1,6 +1,6 @@
-# encoding: utf-8
 # This file is distributed under New Relic's license terms.
-# See https://github.com/newrelic/rpm/blob/master/LICENSE for complete details.
+# See https://github.com/newrelic/newrelic-ruby-agent/blob/main/LICENSE for complete details.
+# frozen_string_literal: true
 
 # This class is used by NewRelic::Agent.set_sql_obfuscator to chain multiple
 # obfuscation blocks when not using the default :replace action

data/lib/new_relic/agent/commands/agent_command.rb

@@ -1,6 +1,6 @@
-# encoding: utf-8
 # This file is distributed under New Relic's license terms.
-# See https://github.com/newrelic/rpm/blob/master/LICENSE for complete details.
+# See https://github.com/newrelic/newrelic-ruby-agent/blob/main/LICENSE for complete details.
+# frozen_string_literal: true
 
 module NewRelic
   module Agent
@@ -9,9 +9,9 @@ module NewRelic
         attr_reader :id, :name, :arguments
 
         def initialize(raw_collector_command)
-          @id        = raw_collector_command[0]
-          @name      = raw_collector_command[1]["name"]
-          @arguments = raw_collector_command[1]["arguments"]
+          @id = raw_collector_command[0]
+          @name = raw_collector_command[1]['name']
+          @arguments = raw_collector_command[1]['arguments']
         end
       end
     end