@newrelic/security-agent 0.0.1

package/lib/nr-security-agent/lib/core/worker.js

@@ -0,0 +1,148 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+// Access the workerData by requiring it.
+const { parentPort, workerData } = require('worker_threads');
+// we need to initialize logger first hand
+const logs = require('./logging');
+const { applicationInfo } = workerData;
+const logger = logs.getLogger(applicationInfo.applicationUUID);
+
+const { SecWebSocket, WSCallbacks, releaseWebSocket } = require('./connections/websocket');
+const {
+    SetDefaultLogLevelHandler,
+    FuzzRequestHandler,
+    setLogger: setResponseHandlerLogger
+} = require('./connections/websocket/response');
+const { SERVER_COMMAND } = require('./sec-agent-constants');
+const { WorkerMessage, WORKER_STATUS } = require('./worker-entities');
+const { Agent } = require('./agent');
+const statusUtils = require('./statusUtils');
+const commonUtils = require('./commonUtils');
+
+
+const MESSAGE = 'message';
+
+const flushInitiatedMsg = new WorkerMessage(WorkerMessage.TYPE.FLUSH, { status: 'initiated' });
+const flushFinishedMsg = new WorkerMessage(WorkerMessage.TYPE.FLUSH, { status: 'flushed' });
+
+let connection;
+// we would want to provide a custome on data
+// handler as the some control comands might
+// need change in current thread, and main thread
+// as well.
+const webSocketCallbacks = new WSCallbacks(null, function (data) {
+    try {
+        const json = JSON.parse(data);
+        if (!json.controlCommand) {
+            return;
+        }
+        // we need some updates in worker threads also
+        switch (json.controlCommand) {
+        case SERVER_COMMAND.SET_DEFAULT_LOG_LEVEL:
+            SetDefaultLogLevelHandler(json);
+            break;
+        case SERVER_COMMAND.FUZZ_REQUEST:
+            FuzzRequestHandler.handler(json);
+            // we would not want this to be duplicated
+            // in main thread, so we would return from here
+            return;
+        default:
+        }
+
+        // send the message to parent in non-blocking mode
+        setImmediate(function () {
+            parentPort.postMessage(new WorkerMessage(WorkerMessage.TYPE.MESSAGE, json));
+        });
+    } catch (err) {
+
+    }
+}, null);
+
+/**
+ * This would initiate the worker and bootstrap
+ * all the necessary configurations.
+ */
+function initWorker () {
+    Agent.init(applicationInfo, logger, null, null);
+    setResponseHandlerLogger(logger);
+    logger.info('Creating websocket connection in worker thread');
+    const validatorService = commonUtils.getValidatorServiceEndpointURL();
+    connection = new SecWebSocket(validatorService, webSocketCallbacks, logger);
+    Agent.getAgent().setClient(connection);
+    // Main thread will pass the data you need
+    // through this event listener.
+    parentPort.on(MESSAGE, handleMessage);
+    // we would set the worker as initialized here
+    process.env.WS_WORKER_STATUS = WORKER_STATUS.RUNNING;
+}
+
+/**
+ * Makes the event queue flush
+ * when the websocket is initialized in
+ * worker, using the connection instance.
+ * This also triggers events to main to mark
+ * the flushing initiated or complete
+ */
+async function flushEventQueueFromWorker () {
+    parentPort.postMessage(flushInitiatedMsg);
+    await connection.flushEventQueue();
+    parentPort.postMessage(flushFinishedMsg);
+}
+
+/**
+ * This handles any messages received from main
+ * if websocket worker is initialized
+ *
+ * @param {JSON} msg
+ */
+function handleMessage (msg) {
+    const workerMsg = WorkerMessage.parseFromObject(msg);
+    if (logger.level && (logger.level.levelStr !== process.env.loglevel)) {
+        logger.level = process.env.loglevel;
+    }
+    switch (workerMsg.getType()) {
+    case WorkerMessage.TYPE.MESSAGE: {
+        connection.dispatch(workerMsg.getPayload());
+        releaseWebSocket();
+        break;
+    }
+    case WorkerMessage.TYPE.FLUSH: {
+        flushEventQueueFromWorker();
+        break;
+    }
+    case WorkerMessage.TYPE.UPDATE_APPLICATION_INFO:
+        Agent.getAgent().setApplicationInfo(workerMsg.getPayload());
+        break;
+    case WorkerMessage.TYPE.RECONNECT: {
+        connection.reconnect();
+        break;
+    }
+    case WorkerMessage.TYPE.OBEY_RECONNECT: {
+        connection.obeyReconnect();
+        break;
+    }
+    default:
+    }
+}
+
+setInterval(() => {
+    try {
+        const buffErrors = statusUtils.getRingBufferedErrors();
+        while (!buffErrors.isEmpty()) {
+            const err = buffErrors.deq();
+            parentPort.postMessage(new WorkerMessage(WorkerMessage.TYPE.ERROR, err));
+        }
+    } catch (error) {
+    }
+}, 240000);
+
+/**
+ * This would initiate the worker when the
+ * module is loaded.
+ */
+(() => {
+    initWorker();
+})();

package/lib/nr-security-agent/lib/core/xss-utils.js

@@ -0,0 +1,297 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+const _ = require('lodash');
+const { AllHtmlEntities } = require('html-entities');
+const decode = require('unescape');
+const querystring = require('querystring');
+
+const { Agent } = require('./agent');
+
+const entities = new AllHtmlEntities();
+
+const tagNameRegex = /<([a-zA-Z_-]+[0-9]*|!--)/gmi;
+const attribRegex = /([^(/\s<'">)]+?)(?:\s*)=\s*(('|")([\s\S]*?)(?:(?=(\\?))\5.)*?\3|.+?(?=\/>|>|\?>|\s|<\/|$))/gmi;
+const ANGLE_END = '>';
+const HTML_COMMENT_END = '-->';
+const HTML_COMMENT_START = '!--';
+const EQUALS = '=';
+const SCRIPT_END = '</SCRIPT';
+const ANGLE_END_CHAR = '>';
+const FIVE_COLON = ':::::';
+const EMPTY_STRING = '';
+const ANGLE_START = '<';
+
+/**
+ * returns detected xss construct if any
+ *
+ * @param {ContextEntity} csecRequest
+ * @param {Object} responseBody
+ * @param {Object} responseHeaders
+ * @returns
+ */
+function checkForReflectedXSS (csecRequest, responseBody, responseHeaders) {
+    const combinedRequestData = decodeRequestData(csecRequest);
+    const combinedResponseData = decodeResponseData(responseBody, responseHeaders);
+
+    const combinedResponseDataString = [...combinedResponseData].join(FIVE_COLON);
+    let attackConstructs = isXSS(combinedRequestData);
+
+    // Agent.getAgent().logger.debug('attackConstructs:', attackConstructs);
+    attackConstructs = Array.from(attackConstructs);
+    for (let i = 0; i < attackConstructs.length; i++) {
+        if (combinedResponseDataString.toLowerCase().includes(attackConstructs[i].toLowerCase())) {
+            Agent.getAgent().logger.debug('construct found::', attackConstructs[i]);
+            return attackConstructs[i];
+        }
+    }
+    return EMPTY_STRING;
+}
+
+function decodeRequestData (csecRequest) {
+    const processedData = new Set();
+    if (csecRequest) {
+        const body = csecRequest.body;
+        const processedUrl = csecRequest.url;
+        let processedBody = body;
+        try {
+            for (const [key, value] of Object.entries(csecRequest.headers)) {
+                // For key
+                processURLEncodedDataForXSS(processedData, key);
+
+                // For Value
+                processURLEncodedDataForXSS(processedData, value);
+            }
+            if (csecRequest.parameterMap) {
+                for (const [key, value] of Object.entries(csecRequest.parameterMap)) {
+                    if (key) {
+                        processURLEncodedDataForXSS(processedData, key.toString());
+                    }
+
+                    if (value) {
+                        processURLEncodedDataForXSS(processedData, value.toString());
+                    }
+                }
+            }
+            const querystringObj = querystring.decode(processedUrl);
+            if (querystringObj) {
+                for (const [key, value] of Object.entries(querystringObj)) {
+                    if (key) {
+                        processURLEncodedDataForXSS(processedData, key.toString());
+                    }
+
+                    if (value) {
+                        processURLEncodedDataForXSS(processedData, value.toString());
+                    }
+                }
+            }
+
+            // For URL
+            processURLEncodedDataForXSS(processedData, processedUrl);
+
+            // For Body
+
+            if (processedBody) {
+                try {
+                    const bodyObject = querystring.decode(processedBody);
+                    if (bodyObject) {
+                        for (const [k, v] of Object.entries(bodyObject)) {
+                            processedData.add(v);
+                            processedData.add(k);
+                        }
+                    }
+                } catch (error) {
+
+                }
+                processedData.add(processedBody);
+
+                const oldProcessedBody = processedBody;
+
+                processedBody = safeDecode(processedBody);
+                if (processedBody !== oldProcessedBody && processedBody.includes(ANGLE_START)) {
+                    processedData.add(processedBody);
+                }
+            }
+        } catch (err) {
+            Agent.getAgent().logger.error('Exception occured while decoding request:', err);
+        }
+    }
+
+    return processedData;
+}
+
+function decodeResponseData (responseBody, responseHeaders) {
+    const processedData = new Set();
+    const processedBody = responseBody || '';
+
+    try {
+        processedData.add(processedBody);
+    } catch (err) {
+        Agent.getAgent().logger.error('Exception occured while decoding response:', err);
+    }
+
+    return processedData;
+}
+
+function isXSS (combinedData) {
+    const attackConstructs = new Set();
+    for (const data of combinedData) {
+        const constructs = getXSSConstructs(data);
+        constructs.forEach(attackConstructs.add, attackConstructs);
+    }
+    return attackConstructs;
+}
+
+function getXSSConstructs (data) {
+    const constructs = new Set();
+    let isAttackConstruct = false;
+    let currPos = 0;
+    let startPos = 0;
+    let tmpCurrPos = 0;
+    let tmpStartPos = 0;
+    let matcher;
+    let attribMatcher;
+    while (currPos < data.length) {
+        let tagName;
+
+        matcher = tagNameRegex.exec(data);
+        if (!matcher) {
+            return constructs;
+        }
+        if ((matcher) !== null) {
+            // This is necessary to avoid infinite loops with zero-width matches
+            if (matcher.index === tagNameRegex.lastIndex) {
+                tagNameRegex.lastIndex++;
+            }
+
+            tagName = matcher[1];
+
+            tagNameRegex.lastIndex = currPos;
+            if (!tagNameRegex.test(data)) {
+                return constructs;
+            }
+
+            if (_.isEmpty(tagName)) {
+                return constructs;
+            }
+
+            startPos = matcher.index;
+            currPos = tagNameRegex.lastIndex - 1;
+
+            if (HTML_COMMENT_START === tagName) {
+                tmpCurrPos = data.indexOf(HTML_COMMENT_END, startPos);
+                if (tmpCurrPos === -1) {
+                    break;
+                } else {
+                    currPos = tmpCurrPos;
+                    continue;
+                }
+            }
+            tmpStartPos = tmpCurrPos = data.indexOf(ANGLE_END, startPos);
+            if (tmpCurrPos === -1) {
+                tmpStartPos = startPos;
+            }
+        }
+        attribRegex.lastIndex = currPos;
+        while ((attribMatcher = attribRegex.exec(data)) !== null) {
+            // This is necessary to avoid infinite loops with zero-width matches
+            if (attribMatcher.index === attribRegex.lastIndex) {
+                attribRegex.lastIndex++;
+            }
+
+            let attribData = _.trim(attribMatcher[0]);
+
+            currPos = attribRegex.lastIndex - 1;
+            tmpCurrPos = data.indexOf(ANGLE_END, tmpStartPos);
+
+            if ((tmpCurrPos === -1 || attribMatcher.index < tmpCurrPos)) {
+                tmpStartPos = tmpCurrPos = attribRegex.lastIndex - 1;
+                tmpStartPos++;
+                if (_.isEmpty(attribMatcher[3]) && attribRegex.lastIndex >= tmpCurrPos) {
+                    tmpStartPos = tmpCurrPos = data.indexOf(ANGLE_END, attribMatcher.index);
+                    if (tmpStartPos > -1) {
+                        attribData = attribData.substring(0, tmpStartPos);
+                    }
+                }
+                const key = attribData.split(EQUALS)[0];
+                const val = attribData.split(EQUALS)[1];
+                const upperCaseAttribKey = key.toUpperCase();
+
+                if (!_.isEmpty(key) && (upperCaseAttribKey.startsWith('ON') || upperCaseAttribKey === 'SRC' || upperCaseAttribKey === 'HREF' ||
+                    upperCaseAttribKey === 'ACTION' || upperCaseAttribKey === 'FORMACTION' || upperCaseAttribKey === 'SRCDOC' ||
+                    upperCaseAttribKey === 'DATA' || decode(val).toUpperCase().replace(/\s/g, '').includes('JAVASCRIPT:') ||
+                    entities.decode(val).toUpperCase().replace(/\s/g, '').includes('JAVASCRIPT:'))) {
+                    isAttackConstruct = true;
+                }
+            } else {
+                break;
+            }
+        }
+
+        if (tmpCurrPos > 0) {
+            currPos = tmpCurrPos;
+        }
+
+        if (data.charAt(currPos) !== ANGLE_END_CHAR) {
+            const tmp = data.indexOf(ANGLE_END, currPos);
+            if (tmp !== -1) {
+                currPos = tmp;
+            } else if (!isAttackConstruct) {
+                continue;
+            }
+        }
+        if (tagName && tagName.toUpperCase().trim() === 'SCRIPT') {
+            const locationOfEndTag = data.toUpperCase().indexOf(SCRIPT_END, currPos);
+            if (locationOfEndTag !== -1) {
+                const body = data.substring(currPos + 1, locationOfEndTag);
+                if (body) {
+                    constructs.add(data.substring(startPos, currPos + 1) + body);
+                    continue;
+                }
+            } else {
+                let body = data.substring(currPos + 1);
+                const tagEnd = body.indexOf(ANGLE_END);
+
+                if (!_.isEmpty(body) && tagEnd !== -1) {
+                    body = data.substring(tagEnd);
+                    constructs.add(data.substring(startPos, currPos + 1) + body);
+                    break;
+                }
+            }
+        }
+
+        if (isAttackConstruct) {
+            constructs.add(data.substring(startPos, currPos + 1));
+        }
+    }
+
+    return constructs;
+}
+
+function processURLEncodedDataForXSS (processedData, data) {
+    let key = data;
+    let oldKey = String(key);
+    do {
+        if (key.includes(ANGLE_START)) {
+            processedData.add(key);
+        }
+        oldKey = key;
+        key = safeDecode(key);
+    } while (oldKey !== key);
+}
+
+function safeDecode (data) {
+    let decodedData = EMPTY_STRING;
+    try {
+        decodedData = decodeURIComponent(data);
+    } catch (err) {
+        decodedData = data;
+    }
+    return decodedData;
+}
+
+module.exports = {
+    checkForReflectedXSS
+};

package/lib/nr-security-agent/lib/models/lambda-delegated-task/constants.js

@@ -0,0 +1,12 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+const CSEC_CALCULATING_APPLICATION_SHA = 'CSEC_CALCULATING_APPLICATION_SHA';
+const CSEC_TASK_PAYLOAD_IDENTIFIER = 'CSEC_TASK_PAYLOAD';
+
+module.exports = {
+    CSEC_TASK_PAYLOAD_IDENTIFIER,
+    CSEC_CALCULATING_APPLICATION_SHA
+};

package/lib/nr-security-agent/lib/models/lambda-delegated-task/index.js

@@ -0,0 +1,15 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+const { LambdaDelegatedTaskType } = require('./lambda-delegated-task-type');
+const { LambdaDelegatedTaskBase } = require('./lambda-delegated-task-base');
+const { LambdaDelegatedTaskShaCalculation } = require('./lambda-delegated-sha-calculation');
+const CONST = require('./constants');
+module.exports = {
+    LambdaDelegatedTaskType,
+    LambdaDelegatedTaskBase,
+    LambdaDelegatedTaskShaCalculation,
+    CONST
+};

package/lib/nr-security-agent/lib/models/lambda-delegated-task/lambda-delegated-sha-calculation.js

@@ -0,0 +1,37 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+const { LambdaDelegatedTaskBase } = require('./lambda-delegated-task-base');
+const ApplicationInfo = require('../../core/applicationinfo');
+const { Agent } = require('../../core/agent');
+const shaSizeUtil = require('../../core/sha-size-util');
+const { CSEC_CALCULATING_APPLICATION_SHA } = require('./constants');
+function LambdaDelegatedTaskShaCalculation (type, ...args) {
+    LambdaDelegatedTaskBase.call(this, type, ...args);
+}
+
+LambdaDelegatedTaskShaCalculation.prototype = LambdaDelegatedTaskBase.prototype;
+LambdaDelegatedTaskShaCalculation.prototype.constructor = LambdaDelegatedTaskShaCalculation;
+
+LambdaDelegatedTaskShaCalculation.prototype.handle = function handleShaCalculation () {
+    process.env[CSEC_CALCULATING_APPLICATION_SHA] = true;
+    const applicationInfo = ApplicationInfo.getInstance();
+    const deployedApplications = applicationInfo && applicationInfo.serverInfo && applicationInfo.serverInfo.deployedApplications;
+
+    // if there are no applications detected
+    if (!deployedApplications) return;
+
+    // calculate and add sha and size info
+    const [application] = deployedApplications;
+    const stat = shaSizeUtil.getApplicationSHAAndSizeSync(application.deployedPath, /.*\/(node_modules)\/.*/);
+    application.sha256 = stat.sha256;
+    application.size = stat.size;
+
+    Agent.getAgent().client.dispatcher(applicationInfo);
+};
+
+module.exports = {
+    LambdaDelegatedTaskShaCalculation
+};

package/lib/nr-security-agent/lib/models/lambda-delegated-task/lambda-delegated-task-base.js

@@ -0,0 +1,50 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+// eslint-disable-next-line no-unused-vars
+const { LambdaDelegatedTaskType } = require('./lambda-delegated-task-type');
+const { CSEC_TASK_PAYLOAD_IDENTIFIER } = require('./constants');
+
+function LambdaDelegatedTaskBase (type, ...args) {
+    this.type = type;
+    this.args = args;
+}
+
+LambdaDelegatedTaskBase.prototype = Object.create(null);
+LambdaDelegatedTaskBase.prototype.constructor = LambdaDelegatedTaskBase;
+
+/**
+ * Returns type of delegated task
+ * @returns {LambdaDelegatedTaskType} type
+ */
+LambdaDelegatedTaskBase.prototype.getType = function getType () {
+    return this.type;
+};
+
+/**
+ * Returns delegated task args
+ * @returns {Array} args
+ */
+LambdaDelegatedTaskBase.prototype.getArgs = function getArgs () {
+    return this.args;
+};
+
+/**
+ * Adds task delegation details to payload
+ * @param {JSON} payload
+ */
+LambdaDelegatedTaskBase.prototype.addToPayload = function addToPayload (payload = {}) {
+    payload[CSEC_TASK_PAYLOAD_IDENTIFIER] = {
+        type: this.type,
+        args: this.args
+    };
+    return payload;
+};
+
+LambdaDelegatedTaskBase.prototype.handle = function noop () {};
+
+module.exports = {
+    LambdaDelegatedTaskBase
+};

package/lib/nr-security-agent/lib/models/lambda-delegated-task/lambda-delegated-task-type.js

@@ -0,0 +1,17 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+const SHA_CALCULATION = 'sha_calculation';
+
+function LambdaDelegatedTaskType () {}
+
+LambdaDelegatedTaskType.prototype = Object.create(null);
+LambdaDelegatedTaskType.prototype.constructor = LambdaDelegatedTaskType;
+
+LambdaDelegatedTaskType.SHA_CALCULATION = SHA_CALCULATION;
+
+module.exports = {
+    LambdaDelegatedTaskType
+};

package/lib/nr-security-agent/resources/cert.pem

@@ -0,0 +1,31 @@
+-----BEGIN CERTIFICATE-----
+MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAw
+TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
+cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4
+WhcNMzUwNjA0MTEwNDM4WjBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJu
+ZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBY
+MTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK3oJHP0FDfzm54rVygc
+h77ct984kIxuPOZXoHj3dcKi/vVqbvYATyjb3miGbESTtrFj/RQSa78f0uoxmyF+
+0TM8ukj13Xnfs7j/EvEhmkvBioZxaUpmZmyPfjxwv60pIgbz5MDmgK7iS4+3mX6U
+A5/TR5d8mUgjU+g4rk8Kb4Mu0UlXjIB0ttov0DiNewNwIRt18jA8+o+u3dpjq+sW
+T8KOEUt+zwvo/7V3LvSye0rgTBIlDHCNAymg4VMk7BPZ7hm/ELNKjD+Jo2FR3qyH
+B5T0Y3HsLuJvW5iB4YlcNHlsdu87kGJ55tukmi8mxdAQ4Q7e2RCOFvu396j3x+UC
+B5iPNgiV5+I3lg02dZ77DnKxHZu8A/lJBdiB3QW0KtZB6awBdpUKD9jf1b0SHzUv
+KBds0pjBqAlkd25HN7rOrFleaJ1/ctaJxQZBKT5ZPt0m9STJEadao0xAH0ahmbWn
+OlFuhjuefXKnEgV4We0+UXgVCwOPjdAvBbI+e0ocS3MFEvzG6uBQE3xDk3SzynTn
+jh8BCNAw1FtxNrQHusEwMFxIt4I7mKZ9YIqioymCzLq9gwQbooMDQaHWBfEbwrbw
+qHyGO0aoSCqI3Haadr8faqU9GY/rOPNk3sgrDQoo//fb4hVC1CLQJ13hef4Y53CI
+rU7m2Ys6xt0nUW7/vGT1M0NPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNV
+HRMBAf8EBTADAQH/MB0GA1UdDgQWBBR5tFnme7bl5AFzgAiIyBpY9umbbjANBgkq
+hkiG9w0BAQsFAAOCAgEAVR9YqbyyqFDQDLHYGmkgJykIrGF1XIpu+ILlaS/V9lZL
+ubhzEFnTIZd+50xx+7LSYK05qAvqFyFWhfFQDlnrzuBZ6brJFe+GnY+EgPbk6ZGQ
+3BebYhtF8GaV0nxvwuo77x/Py9auJ/GpsMiu/X1+mvoiBOv/2X/qkSsisRcOj/KK
+NFtY2PwByVS5uCbMiogziUwthDyC3+6WVwW6LLv3xLfHTjuCvjHIInNzktHCgKQ5
+ORAzI4JMPJ+GslWYHb4phowim57iaztXOoJwTdwJx4nLCgdNbOhdjsnvzqvHu7Ur
+TkXWStAmzOVyyghqpZXjFaH3pO3JLF+l+/+sKAIuvtd7u+Nxe5AW0wdeRlN8NwdC
+jNPElpzVmbUq4JUagEiuTDkHzsxHpFKVK7q4+63SM1N95R1NbdWhscdCb+ZAJzVc
+oyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq
+4RgqsahDYVvTH9w7jXbyLeiNdd8XM2w9U/t7y0Ff/9yi0GE44Za4rF2LN9d11TPA
+mRGunUHBcnWEvgJBQl9nJEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57d
+emyPxgcYxn/eR44/KJ4EBs+lVDR3veyJm+kXQ99b21/+jh5Xos1AnX5iItreGCc=
+-----END CERTIFICATE-----

package/lib/nr-security-agent/resources/config.js

@@ -0,0 +1,19 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const path = require('path');
+
+const AGENT_DIR = path.join(__dirname, '../../../');
+const uuidv4 = require('uuid/v4');
+process.env.applicationUUID = process.env.applicationUUID || uuidv4();
+
+module.exports = {
+    AGENT_DIR,
+    ENV: process.env.CSEC_ENV,
+    APPLICATION_INFO_PUBLISH_MAX_WAIT: 10000, // milliseconds
+    HC_INTERVAL_MS: 300000, // milliseconds
+    MAX_PENDING_QUEUE_LENGTH: 1000,
+    MAX_EVENT_RATE: 1200, // EVENTS/sec
+    DEFAULT_LOG_CHANGETIME: 300000 // milliseconds
+};

package/lib/nr-security-agent/resources/default-policy.yaml

@@ -0,0 +1,36 @@
+version: "DEFAULT"
+logLevel: "INFO"
+policyPull: true
+policyPullInterval: 60
+vulnerabilityScan:
+  enabled: false
+  cveScan:
+    enabled: false
+    enableEnvScan: false
+    cveDefinitionUpdateInterval: 360
+  iastScan:
+    enabled: false
+    probing:
+      interval: 1
+      batchSize: 17
+protectionMode:
+  enabled: false
+  ipBlocking:
+    enabled: false
+    attackerIpBlocking: false
+    ipDetectViaXFF: false
+    timeout: 2
+  apiBlocking:
+    enabled: false
+    protectAllApis: false
+    protectKnownVulnerableApis: false
+    protectAttackedApis: false
+sendCompleteStackTrace: false
+enableHTTPRequestPrinting: false
+policyParameters:
+  allowedIps: []
+  blockedIps: []
+  allowedApis: []
+  blockedApis: []
+  allowedRequests: []
+