@depup/elastic-apm-node 4.15.0-depup.0

package/lib/parsers.js

@@ -0,0 +1,225 @@
+/*
+ * Copyright Elasticsearch B.V. and other contributors where applicable.
+ * Licensed under the BSD 2-Clause License; you may not use this file except in
+ * compliance with the BSD 2-Clause License.
+ */
+
+'use strict';
+
+const url = require('url');
+
+const basicAuth = require('basic-auth');
+const getUrlFromRequest = require('original-url');
+const parseHttpHeadersFromReqOrRes = require('http-headers');
+const cookie = require('cookie');
+const stringify = require('fast-safe-stringify');
+
+const REDACTED = require('./constants').REDACTED;
+const {
+  redactKeysFromObject,
+  redactKeysFromPostedFormVariables,
+} = require('./filters/sanitize-field-names');
+
+// When redacting individual cookie field values, this string is used instead
+// of `[REDACTED]`. The APM spec says:
+//    > The replacement string SHOULD be `[REDACTED]`.
+// We diverge from spec here because, for better or worse, the `cookie` module
+// does `encodeURIComponent/decodeURIComponent` encoding on cookie fields. If we
+// used the brackets, then the reconstructed cookie would look like
+// `foo=bar; session-id=%5BREDACTED%5D`, which isn't helpful.
+const COOKIE_VAL_REDACTED = 'REDACTED';
+
+/**
+ * Extract appropriate `{transaction,error}.context.request` from an HTTP
+ * request object. This handles header and body capture and redaction
+ * according to the agent config.
+ *
+ * @param {Object} req - Typically `req` is a Node.js `http.IncomingMessage`
+ *    (https://nodejs.org/api/all.html#all_http_class-httpincomingmessage).
+ *    However, some cases (e.g. Lambda and Azure Functions instrumentation)
+ *    create a pseudo-req object that matches well enough for this function.
+ *    Some relevant fields: (TODO: document all used fields)
+ *    - `headers` - Required. An object.
+ *    - `body` - The incoming request body, if available. The `json` and
+ *      `payload` fields are also checked to accomodate some web frameworks.
+ *    - `bodyIsBase64Encoded` - An optional boolean. If `true`, then the `body`
+ *      needs to be base64-decoded before inclusion and redaction. Used by
+ *      Lambda instrumentation in some cases (e.g. for ELB triggers).
+ * @param {Object} conf - The full agent configuration.
+ * @param {String} type - 'errors' or 'transactions'. Indicates if this req
+ *    is being captured for an APM error or transaction event.
+ */
+function getContextFromRequest(req, conf, type) {
+  var captureBody = conf.captureBody === type || conf.captureBody === 'all';
+
+  var context = {
+    http_version: req.httpVersion,
+    method: req.method,
+    url: getUrlFromRequest(req),
+    headers: undefined,
+  };
+  if (req.socket && req.socket.remoteAddress) {
+    context.socket = {
+      remote_address: req.socket.remoteAddress,
+    };
+  }
+
+  if (conf.captureHeaders) {
+    context.headers = redactKeysFromObject(
+      req.headers,
+      conf.sanitizeFieldNamesRegExp,
+    );
+
+    if (context.headers.cookie && context.headers.cookie !== REDACTED) {
+      let cookies = cookie.parse(req.headers.cookie);
+      cookies = redactKeysFromObject(
+        cookies,
+        conf.sanitizeFieldNamesRegExp,
+        COOKIE_VAL_REDACTED,
+      );
+      try {
+        context.headers.cookie = Object.keys(cookies)
+          .map((k) => cookie.serialize(k, cookies[k]))
+          .join('; ');
+      } catch (_err) {
+        // Fallback to full redaction if there is an issue re-serializing.
+        context.headers.cookie = REDACTED;
+      }
+    }
+  }
+
+  var contentLength = parseInt(req.headers['content-length'], 10);
+  var transferEncoding = req.headers['transfer-encoding'];
+  var chunked =
+    typeof transferEncoding === 'string' &&
+    transferEncoding.toLowerCase() === 'chunked';
+  var body = req.json || req.body || req.payload;
+  var haveBody = body && (chunked || contentLength > 0);
+
+  if (haveBody) {
+    if (!captureBody) {
+      context.body = '[REDACTED]';
+    } else if (Buffer.isBuffer(body)) {
+      context.body = '<Buffer>';
+    } else {
+      if (typeof body === 'string' && req.bodyIsBase64Encoded === true) {
+        body = Buffer.from(body, 'base64').toString('utf8');
+      }
+      body = redactKeysFromPostedFormVariables(
+        body,
+        req.headers,
+        conf.sanitizeFieldNamesRegExp,
+      );
+      if (typeof body !== 'string') {
+        body = tryJsonStringify(body) || stringify(body);
+      }
+      context.body = body;
+    }
+  }
+
+  // TODO: Tempoary fix for https://github.com/elastic/apm-agent-nodejs/issues/813
+  if (context.url && context.url.port) {
+    context.url.port = String(context.url.port);
+  }
+
+  return context;
+}
+
+/**
+ * Extract appropriate `{transaction,error}.context.response` from an HTTP
+ * response object. This handles header redaction according to the agent config.
+ *
+ * @param {Object} res - Typically `res` is a Node.js `http.ServerResponse`
+ *    (https://nodejs.org/api/http.html#class-httpserverresponse).
+ *    However, some cases (e.g. Lambda and Azure Functions instrumentation)
+ *    create a pseudo-res object that matches well enough for this function.
+ *    Some relevant fields: (TODO: document all used fields)
+ *    - `statusCode` - Required. A number.
+ *    - `headers` - An object.
+ *    - `headersSent` - Boolean indicating if the headers have been sent
+ *       (https://nodejs.org/api/http.html#outgoingmessageheaderssent)
+ *    - `finished` - Boolean indicating if `response.end()` has been called
+ *       (https://nodejs.org/api/http.html#responsefinished)
+ * @param {Object} conf - The full agent configuration.
+ * @param {Boolean} isError - Indicates if this response contains an error and
+ *    some extra fields should be added to the context
+ */
+function getContextFromResponse(res, conf, isError) {
+  var context = {
+    status_code: res.statusCode,
+    headers: undefined,
+  };
+
+  if (conf.captureHeaders) {
+    context.headers = res.headers || parseHttpHeadersFromReqOrRes(res, true);
+    context.headers = redactKeysFromObject(
+      context.headers,
+      conf.sanitizeFieldNamesRegExp,
+    );
+  }
+
+  if (isError) {
+    context.headers_sent = res.headersSent;
+    if (typeof res.finished === 'boolean') {
+      context.finished = res.finished;
+    } else {
+      context.finished = res.writableEnded;
+    }
+  }
+
+  return context;
+}
+
+/**
+ * Extract appropriate `{transaction,error}.context.user` from an HTTP
+ * request object.
+ *
+ * @param {Object} req - Typically `req` is a Node.js `http.IncomingMessage`.
+ *    However, some cases (e.g. Lambda and Azure Functions instrumentation)
+ *    create a pseudo-req object that matches well enough for this function.
+ *    Some relevant fields: (TODO: document all used fields)
+ *    - `headers` - Required. An object.
+ */
+function getUserContextFromRequest(req) {
+  var user = req.user || basicAuth(req) || req.session;
+  if (!user) {
+    return;
+  }
+
+  var context = {};
+
+  if (typeof user.id === 'string' || typeof user.id === 'number') {
+    context.id = user.id;
+  } else if (typeof user._id === 'string' || typeof user._id === 'number') {
+    context.id = user._id;
+  }
+
+  if (typeof user.username === 'string') {
+    context.username = user.username;
+  } else if (typeof user.name === 'string') {
+    context.username = user.name;
+  }
+
+  if (typeof user.email === 'string') {
+    context.email = user.email;
+  }
+
+  return context;
+}
+
+function parseUrl(urlStr) {
+  return new url.URL(urlStr, 'relative:///');
+}
+
+function tryJsonStringify(obj) {
+  try {
+    return JSON.stringify(obj);
+  } catch (e) {}
+}
+
+module.exports = {
+  getContextFromRequest,
+  getContextFromResponse,
+  getUserContextFromRequest,
+  parseUrl,
+};

package/lib/propwrap.js

@@ -0,0 +1,147 @@
+/*
+ * Copyright Elasticsearch B.V. and other contributors where applicable.
+ * Licensed under the BSD 2-Clause License; you may not use this file except in
+ * compliance with the BSD 2-Clause License.
+ */
+
+'use strict';
+
+// Utilities to wrap properties of an object.
+//
+// This is similar to "./instrumentation/shimmer.js". However, it uses a
+// different technique to support wrapping properties that are only available
+// via a getter (i.e. their property descriptor is `.writable === false`).
+
+/*
+ * This block is derived from esbuild's bundling support.
+ * https://github.com/evanw/esbuild/blob/v0.14.42/internal/runtime/runtime.go#L22
+ *
+ * License:
+ * MIT License
+ *
+ * Copyright (c) 2020 Evan Wallace
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __copyProps = (to, from, except, desc) => {
+  if ((from && typeof from === 'object') || typeof from === 'function') {
+    for (const key of __getOwnPropNames(from)) {
+      if (!__hasOwnProp.call(to, key) && key !== except) {
+        __defProp(to, key, {
+          get: () => from[key],
+          enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable,
+        });
+      }
+    }
+  }
+  return to;
+};
+
+/**
+ * Return a new object that is a copy of `obj`, with its `subpath` property
+ * replaced with the return value of `wrapper(original)`.
+ *
+ * For example:
+ *    var os = wrap(require('os'), 'platform', (orig) => {
+ *      return function wrappedPlatform () {
+ *        return orig().toUpperCase()
+ *      }
+ *    })
+ *    console.log(os.platform()) // => DARWIN
+ *
+ * The subpath can indicate a nested property. Each property in that subpath,
+ * except the last, must identify an *Object*.
+ *
+ * Limitations:
+ * - This doesn't handle possible Symbol properties on the copied object(s).
+ * - This cannot wrap a property of a function, because we cannot create a
+ *   copy of the function.
+ *
+ * @param {Object} obj
+ * @param {String} subpath - The property subpath on `obj` to wrap. This may
+ *    point to a nested property by using a '.' to separate levels. For example:
+ *        var fs = wrap(fs, 'promises.sync', (orig) => { ... })
+ * @param {Function} wrapper - A function of the form `function (orig)`, where
+ *    `orig` is the original property value. This must synchronously return the
+ *    new property value.
+ * @returns {Object} A new object with the wrapped property.
+ * @throws {TypeError} if the subpath points to a non-existant property, or if
+ *    any but the last subpath part points to a non-Object.
+ */
+function wrap(obj, subpath, wrapper) {
+  const parts = subpath.split('.');
+  const namespaces = [obj];
+  let namespace = obj;
+  let key;
+  let val;
+
+  // 1. Traverse the subpath parts to sanity check and get references to the
+  //    Objects that will will be copying.
+  for (let i = 0; i < parts.length; i++) {
+    key = parts[i];
+    val = namespace[key];
+    if (!val) {
+      throw new TypeError(
+        `cannot wrap "${subpath}": "<obj>.${parts
+          .slice(0, i)
+          .join('.')}" is ${typeof val}`,
+      );
+    } else if (i < parts.length - 1) {
+      if (typeof val !== 'object') {
+        throw new TypeError(
+          `cannot wrap "${subpath}": "<obj>.${parts
+            .slice(0, i)
+            .join('.')}" is not an Object`,
+        );
+      }
+      namespace = val;
+      namespaces.push(namespace);
+    }
+  }
+
+  // 2. Now work backwards, wrapping each namespace with a new object that has a
+  //    copy of all the properties, except the one that we've wrapped.
+  for (let i = parts.length - 1; i >= 0; i--) {
+    key = parts[i];
+    namespace = namespaces[i];
+    if (i === parts.length - 1) {
+      const orig = namespace[key];
+      val = wrapper(orig);
+    } else {
+      val = namespaces[i + 1];
+    }
+    const desc = __getOwnPropDesc(namespace, key);
+    const wrappedNamespace = __defProp({}, key, {
+      value: val,
+      enumerable: !desc || desc.enumerable,
+    });
+    __copyProps(wrappedNamespace, namespace, key);
+    namespaces[i] = wrappedNamespace;
+  }
+
+  return namespaces[0];
+}
+
+module.exports = {
+  wrap,
+};