newrelic_rpm 9.9.0 → 9.21.0

data/lib/new_relic/rack/browser_monitoring.rb

@@ -20,15 +20,15 @@ module NewRelic
       # examine in order to look for a RUM insertion point.
       SCAN_LIMIT = 50_000
 
-      CONTENT_TYPE = 'Content-Type'.freeze
-      CONTENT_DISPOSITION = 'Content-Disposition'.freeze
-      CONTENT_LENGTH = 'Content-Length'.freeze
+      CONTENT_TYPE = 'Content-Type'
+      CONTENT_DISPOSITION = 'Content-Disposition'
+      CONTENT_LENGTH = 'Content-Length'
       ATTACHMENT = /attachment/.freeze
       TEXT_HTML = %r{text/html}.freeze
 
-      BODY_START = '<body'.freeze
-      HEAD_START = '<head'.freeze
-      GT = '>'.freeze
+      BODY_START = '<body'
+      HEAD_START = '<head'
+      GT = '>'
 
       ALREADY_INSTRUMENTED_KEY = 'newrelic.browser_monitoring_already_instrumented'
       CHARSET_RE = /<\s*meta[^>]+charset\s*=[^>]*>/im.freeze
@@ -38,7 +38,7 @@ module NewRelic
         result = @app.call(env)
         (status, headers, response) = result
 
-        js_to_inject = NewRelic::Agent.browser_timing_header
+        js_to_inject = NewRelic::Agent.browser_timing_header(nonce(env))
         if (js_to_inject != NewRelic::EMPTY_STR) && should_instrument?(env, status, headers)
           response_string = autoinstrument_source(response, js_to_inject)
           if headers.key?(CONTENT_LENGTH)
@@ -58,6 +58,14 @@ module NewRelic
         end
       end
 
+      def nonce(env)
+        return unless NewRelic::Agent.config[:'browser_monitoring.content_security_policy_nonce']
+        return unless NewRelic::Agent.config[:framework] == :rails_notifications
+        return unless defined?(ActionDispatch::ContentSecurityPolicy::Request)
+
+        env[ActionDispatch::ContentSecurityPolicy::Request::NONCE]
+      end
+
       def should_instrument?(env, status, headers)
         NewRelic::Agent.config[:'browser_monitoring.auto_instrument'] &&
           status == 200 &&
@@ -112,7 +120,11 @@ module NewRelic
       end
 
       def streaming?(env, headers)
-        # Chunked transfer encoding is a streaming data transfer mechanism available only in HTTP/1.1
+        # Up until version 8.0, Rails would set 'Transfer-Encoding' to 'chunked'
+        # to trigger the desired HTTP/1.1 based streaming functionality in Rack.
+        # With version v8.0+, Rails assumes that the web server will be using
+        # Rack v3+ or an equally modern alternative and simply leaves the
+        # streaming behavior up to them.
         return true if headers && headers['Transfer-Encoding'] == 'chunked'
 
         defined?(ActionController::Live) &&

data/lib/new_relic/version.rb

@@ -6,7 +6,7 @@
 module NewRelic
   module VERSION # :nodoc:
     MAJOR = 9
-    MINOR = 9
+    MINOR = 21
     TINY = 0
 
     STRING = "#{MAJOR}.#{MINOR}.#{TINY}"

data/lib/sequel/extensions/new_relic_instrumentation.rb

@@ -78,8 +78,9 @@ module Sequel
     end
 
     THREAD_SAFE_CONNECTION_POOL_CLASSES = [
-      (defined?(::Sequel::ThreadedConnectionPool) && ::Sequel::ThreadedConnectionPool)
-    ].freeze
+      (defined?(::Sequel::ThreadedConnectionPool) && ::Sequel::ThreadedConnectionPool),
+      (defined?(::Sequel::TimedQueueConnectionPool) && NewRelic::Helper.version_satisfied?(RUBY_VERSION, '>=', '3.2') && ::Sequel::TimedQueueConnectionPool)
+    ].compact.freeze
 
     def explainer_for(sql)
       proc do |*|

data/lib/tasks/config.rake

@@ -20,15 +20,19 @@ namespace :newrelic do
       ATTRIBUTES => '[Attributes](/docs/features/agent-attributes) are key-value pairs containing information that determines the properties of an event or transaction. These key-value pairs can be viewed within transaction traces in APM, traced errors in APM, transaction events in dashboards, and page views in dashboards. You can customize exactly which attributes will be sent to each of these destinations',
       'transaction_tracer' => 'The [transaction traces](/docs/apm/traces/transaction-traces/transaction-traces) feature collects detailed information from a selection of transactions, including a summary of the calling sequence, a breakdown of time spent, and a list of SQL queries and their query plans (on mysql and postgresql). Available features depend on your New Relic subscription level.',
       'error_collector' => "The agent collects and reports all uncaught exceptions by default. These configuration options allow you to customize the error collection.\n\nFor information on ignored and expected errors, [see this page on Error Analytics in APM](/docs/agents/manage-apm-agents/agent-data/manage-errors-apm-collect-ignore-or-mark-expected/). To set expected errors via the `NewRelic::Agent.notice_error` Ruby method, [consult the Ruby agent API](/docs/agents/ruby-agent/api-guides/sending-handled-errors-new-relic/).",
-      'browser_monitoring' => "The browser monitoring [page load timing](/docs/browser/new-relic-browser/page-load-timing/page-load-timing-process) feature (sometimes referred to as real user monitoring or RUM) gives you insight into the performance real users are experiencing with your website. This is accomplished by measuring the time it takes for your users' browsers to download and render your web pages by injecting a small amount of JavaScript code into the header and footer of each page.",
+      'browser_monitoring' => "The <InlinePopover type='browser' /> [page load timing](/docs/browser/new-relic-browser/page-load-timing/page-load-timing-process) feature (sometimes referred to as real user monitoring or RUM) gives you insight into the performance real users are experiencing with your website. This is accomplished by measuring the time it takes for your users' browsers to download and render your web pages by injecting a small amount of JavaScript code into the header and footer of each page.",
       'application_logging' => "The Ruby agent supports [APM logs in context](/docs/apm/new-relic-apm/getting-started/get-started-logs-context). For some tips on configuring logs for the Ruby agent, see [Configure Ruby logs in context](/docs/logs/logs-context/configure-logs-context-ruby).\n\nAvailable logging-related config options include:",
       'analytics_events' => '[New Relic dashboards](/docs/query-your-data/explore-query-data/dashboards/introduction-new-relic-one-dashboards) is a resource to gather and visualize data about your software and what it says about your business. With it you can quickly and easily create real-time dashboards to get immediate answers about end-user experiences, clickstreams, mobile activities, and server transactions.',
-      'ai_monitoring' => "This section includes Ruby agent configurations for setting up AI monitoring.\n\n<Callout variant='important'>You need to enable distributed tracing to capture trace and feedback data. It is turned on by default in Ruby agents 8.0.0 and higher.</Callout>"
+      'ai_monitoring' => "This section includes Ruby agent configurations for setting up AI monitoring.\n\n<Callout variant='important'>You need to enable distributed tracing to capture trace and feedback data. It is turned on by default in Ruby agents 8.0.0 and higher.</Callout>",
+      'security_agent' => "[New Relic Interactive Application Security Testing](https://docs.newrelic.com/docs/iast/introduction/) (IAST) tests your applications for any exploitable vulnerability by replaying the generated HTTP request with vulnerable payloads.\n\n<Callout variant='important'>Run IAST with non-production deployments only to avoid exposing vulnerabilities on your production software. \
+        IAST mode requires Ruby agent version 9.12.0 or higher and the [newrelic_security](https://rubygems.org/gems/newrelic_security) gem. Security agent configurations are disabled by default.</Callout>"
     }
 
     NAME_OVERRIDES = {
       'slow_sql' => 'Slow SQL [#slow-sql]',
-      'custom_insights_events' => 'Custom Events [#custom-events]'
+      'custom_insights_events' => 'Custom Events [#custom-events]',
+      'ai_monitoring' => 'AI Monitoring [#ai-monitoring]',
+      'security_agent' => 'Security Agent [#security-agent]'
     }
 
     desc 'Describe available New Relic configuration settings'

data/lib/tasks/gha.rake

@@ -0,0 +1,31 @@
+# This file is distributed under New Relic's license terms.
+# See https://github.com/newrelic/newrelic-ruby-agent/blob/main/LICENSE for complete details.
+# frozen_string_literal: true
+
+require 'yaml'
+require_relative 'helpers/version_bump'
+
+# gha = GitHub Actions
+namespace :gha do
+  # See .github/versions.yml
+  desc 'Update 3rd party action versions across all workflows'
+  task :update_versions do
+    gh_dir = File.expand_path('../../../.github', __FILE__)
+    info = YAML.load_file(File.join(gh_dir, 'versions.yml'))
+    workflows = Dir.glob(File.join(gh_dir, 'workflows', '*.yml'))
+    workflows.each do |workflow|
+      original = File.read(workflow)
+      modified = original.dup
+      info.each do |action, settings|
+        modified.gsub!(/uses: #{action}.*$/, "uses: #{action}@#{settings[:sha]} # tag #{settings[:tag]}")
+      end
+
+      if original != modified
+        File.open(workflow, 'w') { |f| f.puts modified }
+        puts "Updated #{workflow} with changes"
+      else
+        puts "#{workflow} remains unchanged"
+      end
+    end
+  end
+end

data/lib/tasks/helpers/config.html.erb

@@ -10,6 +10,7 @@ redirects:
   - /docs/ruby/ruby-agent-configuration
   - /docs/agents/ruby-agent/installation-and-configuration/ruby-agent-configuration
   - /docs/agents/ruby-agent/installation-configuration/ruby-agent-configuration
+freshnessValidatedDate: never
 ---
 
 <CONTRIBUTOR_NOTE>
@@ -70,12 +71,12 @@ The Ruby agent looks for the following environment variables, in this order, to
 
 If the Ruby agent doesn't detect values for any of those environment variables, it will default the application environment to `development` and read from the `development` section of the `newrelic.yml` config file.
 
-When running the Ruby agent in a Rails app, the agent first looks for the `NEW_RELIC_ENV` environment variable to determine the application environment and which section of the `newrelic.yml` to use. If `NEW_RELIC_ENV` is not present, the agent uses the Rails environment (`RAILS_ENV`).
+When running the Ruby agent in a Rails app, the agent first looks for the `NEW_RELIC_ENV` environment variable to find the application environment and which section of the `newrelic.yml` to use. If `NEW_RELIC_ENV` is not present, the agent uses the Rails environment (`RAILS_ENV`).
 
 When you edit the config file, be sure to:
 
 * Indent only with two spaces.
-* Indent only where relevant, in stanzas such as **`error_collector`**.
+* Indent only where relevant, in sections such as **`error_collector`**.
 
 If you do not indent correctly, the agent may throw an `Unable to parse configuration file` error on startup.
 

data/lib/tasks/helpers/format.rb

@@ -69,7 +69,7 @@ module Format
 
   def format_description(value)
     description = ''
-    description += '**DEPRECATED** ' if value[:deprecated]
+    description += '<DNT>**DEPRECATED**</DNT> ' if value[:deprecated]
     description += value[:description]
     description
   end

data/lib/tasks/helpers/newrelicyml.rb

@@ -45,6 +45,34 @@ module NewRelicYML
 
   HEADER
 
+  SECURITY_BEGIN = <<-SECURITY
+  # BEGIN security agent
+  #
+  #   NOTE: At this time, the security agent is intended for use only within
+  #         a dedicated security testing environment with data that can tolerate
+  #         modification or deletion. The security agent is available as a
+  #         separate Ruby gem, newrelic_security. It is recommended that this
+  #         separate gem only be introduced to a security testing environment
+  #         by leveraging Bundler grouping like so:
+  #
+  #         # Gemfile
+  #         gem 'newrelic_rpm'               # New Relic APM observability agent
+  #         gem 'newrelic-infinite_tracing'  # New Relic Infinite Tracing
+  #
+  #         group :security do
+  #           gem 'newrelic_security', require: false # New Relic security agent
+  #         end
+  #
+  #   NOTE: All "security.*" configuration parameters are related only to the
+  #         security agent, and all other configuration parameters that may
+  #         have "security" in the name somewhere are related to the APM agent.
+  
+  SECURITY
+
+  SECURITY_END = <<-SECURITY
+  # END security agent
+  SECURITY
+
   FOOTER = <<~FOOTER
     # Environment-specific settings are in this section.
     # RAILS_ENV or RACK_ENV (as appropriate) is used to determine the environment.
@@ -67,16 +95,35 @@ module NewRelicYML
   FOOTER
 
   def self.get_configs(defaults)
-    defaults.sort.each_with_object({}) do |(key, value), final_configs|
+    agent_configs = {}
+    security_configs = {}
+
+    defaults.sort.each do |key, value|
       next if CRITICAL.include?(key) || SKIP.include?(key)
 
       next unless public_config?(value) && !deprecated?(value)
 
-      sanitized_description = sanitize_description(value[:description])
-      description = format_description(sanitized_description)
-      default = default_value(key, value)
-      final_configs[key] = {description: description, default: default}
+      # TODO: OLD RUBIES < 2.6
+      # Remove `to_s`. `start_with?` doesn't accept symbols in Ruby <2.6
+      if key.to_s.start_with?('security.')
+        description, default = build_config(key, value)
+        security_configs[key] = {description: description, default: default}
+        next
+      end
+
+      description, default = build_config(key, value)
+      agent_configs[key] = {description: description, default: default}
     end
+
+    [agent_configs, security_configs]
+  end
+
+  def self.build_config(key, value)
+    sanitized_description = sanitize_description(value[:description])
+    description = format_description(sanitized_description)
+    default = default_value(key, value)
+
+    [description, default]
   end
 
   def self.public_config?(value)
@@ -94,6 +141,8 @@ module NewRelicYML
     description.gsub!(/<InlinePopover type="(.*)" \/>/, '\1')
     # remove hyperlinks
     description.gsub!(/\[([^\]]+)\]\([^\)]+\)/, '\1')
+    # delete lines with code fences including the language
+    description.gsub!(/```[a-zA-Z0-9_]*\n(.*?)```/m, '\1')
     # remove single pairs of backticks
     description.gsub!(/`([^`]+)`/, '\1')
     # removed href links
@@ -103,10 +152,13 @@ module NewRelicYML
   end
 
   def self.format_description(description)
+    # remove all tab characters
+    description.delete!("\t")
     # remove leading and trailing whitespace
     description.strip!
-    # wrap text after 80 characters
-    description.gsub!(/(.{1,80})(\s+|\Z)/, "\\1\n")
+    # wrap text after 80 characters, assuming we're at one tabstop's (two
+    # spaces') level of indentation already, keep leading whitespace
+    description.gsub!(/(.{1,78})(\s|\Z)/, "\\1\n")
     # add hashtags to lines
     description = description.split("\n").map { |line| "  # #{line}" }.join("\n")
 
@@ -125,15 +177,30 @@ module NewRelicYML
     end
   end
 
-  def self.build_string(defaults)
-    configs = get_configs(defaults)
-    yml_string = ''
+  def self.agent_configs_yml(agent_configs)
+    agent_yml = ''
+    agent_configs.each do |key, value|
+      agent_yml += "#{value[:description]}\n  # #{key}: #{value[:default]}\n\n"
+    end
+
+    agent_yml
+  end
 
-    configs.each do |key, value|
-      yml_string += "#{value[:description]}\n  # #{key}: #{value[:default]}\n\n"
+  def self.security_configs_yml(security_configs)
+    security_yml = ''
+    security_configs.each do |key, value|
+      security_yml += "#{value[:description]}\n  # #{key}: #{value[:default]}\n\n"
     end
 
-    yml_string
+    security_yml
+  end
+
+  def self.build_string(defaults)
+    agent_configs, security_configs = get_configs(defaults)
+    agent_string = agent_configs_yml(agent_configs)
+    security_string = security_configs_yml(security_configs)
+
+    agent_string + SECURITY_BEGIN + security_string + SECURITY_END + "\n"
   end
 
   # :nocov: