@newrelic/security-agent 0.0.1

package/lib/instrumentation-security/core/stack-trace.js

@@ -0,0 +1,156 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+ 'use strict';
+
+ const AsyncHooks = require('async_hooks');
+ 
+ const NEW_LINE_IDENTIFIER = '\n';
+ const NATIVE_LITERAL = 'native';
+ const DOT_CHARACTER = '.';
+ const MODULE_IDENTIFIER = '.Module';
+ const ANONYMOUS_IDENTIFIER = '<anonymous>';
+ 
+ const lineRegex = /at (?:(.+)\s+\()?(?:(.+?):(\d+)(?::(\d+))?|([^)]+))\)?/;
+ const GET = 'get';
+ const IS = 'is';
+ 
+ exports.get = function (belowFn) {
+     const oldLimit = Error.stackTraceLimit;
+     Error.stackTraceLimit = 18;
+     const dummyObject = {};
+ 
+     const eid = AsyncHooks.executionAsyncId();
+ 
+     const v8Handler = Error.prepareStackTrace;
+     Error.prepareStackTrace = function (dummyObject, v8StackTrace) {
+         return v8StackTrace;
+     };
+     Error.captureStackTrace(dummyObject, belowFn || exports.get);
+ 
+     const v8StackTrace = dummyObject.stack;
+     Error.prepareStackTrace = v8Handler;
+     Error.stackTraceLimit = oldLimit;
+ 
+     return v8StackTrace;
+ };
+ 
+ exports.parse = function (err) {
+     if (!err.stack) {
+         return [];
+     }
+ 
+     const self = this;
+     const lines = err.stack.split(NEW_LINE_IDENTIFIER).slice(1);
+ 
+     return lines
+         .map(function (line) {
+             if (line.match(/^\s*[-]{4,}$/)) {
+                 return self._createParsedCallSite({
+                     fileName: line,
+                     lineNumber: null,
+                     functionName: null,
+                     typeName: null,
+                     methodName: null,
+                     columnNumber: null,
+                     native: null
+                 });
+             }
+ 
+             const lineMatch = line.match(lineRegex);
+             if (!lineMatch) {
+                 return;
+             }
+ 
+             let object = null;
+             let method = null;
+             let functionName = null;
+             let typeName = null;
+             let methodName = null;
+             const isNative = (lineMatch[5] === NATIVE_LITERAL);
+ 
+             if (lineMatch[1]) {
+                 functionName = lineMatch[1];
+                 let methodStart = functionName.lastIndexOf(DOT_CHARACTER);
+                 if (functionName[methodStart - 1] === DOT_CHARACTER) { methodStart-- }
+                 if (methodStart > 0) {
+                     object = functionName.substr(0, methodStart);
+                     method = functionName.substr(methodStart + 1);
+                     const objectEnd = object.indexOf(MODULE_IDENTIFIER);
+                     if (objectEnd > 0) {
+                         functionName = functionName.substr(objectEnd + 1);
+                         object = object.substr(0, objectEnd);
+                     }
+                 }
+                 typeName = null;
+             }
+ 
+             if (method) {
+                 typeName = object;
+                 methodName = method;
+             }
+ 
+             if (method === ANONYMOUS_IDENTIFIER) {
+                 methodName = null;
+                 functionName = null;
+             }
+ 
+             const properties = {
+                 fileName: lineMatch[2] || null,
+                 lineNumber: parseInt(lineMatch[3], 10) || null,
+                 functionName: functionName,
+                 typeName: typeName,
+                 methodName: methodName,
+                 columnNumber: parseInt(lineMatch[4], 10) || null,
+                 native: isNative
+             };
+ 
+             return self._createParsedCallSite(properties);
+         })
+         .filter(function (callSite) {
+             return !!callSite;
+         });
+ };
+ 
+ function CallSite (properties) {
+     for (const property in properties) {
+         this[property] = properties[property];
+     }
+ }
+ 
+ const strProperties = [
+     'this',
+     'typeName',
+     'functionName',
+     'methodName',
+     'fileName',
+     'lineNumber',
+     'columnNumber',
+     'function',
+     'evalOrigin'
+ ];
+ const boolProperties = [
+     'topLevel',
+     'eval',
+     'native',
+     'constructor'
+ ];
+ strProperties.forEach(function (property) {
+     CallSite.prototype[property] = null;
+     CallSite.prototype[GET + property[0].toUpperCase() + property.substr(1)] = function () {
+         return this[property];
+     };
+ });
+ boolProperties.forEach(function (property) {
+     CallSite.prototype[property] = false;
+     CallSite.prototype[IS + property[0].toUpperCase() + property.substr(1)] = function () {
+         return this[property];
+     };
+ });
+ 
+ exports._createParsedCallSite = function (properties) {
+     return new CallSite(properties);
+ };
+ 

package/lib/instrumentation-security/hooks/director/nr-director.js

@@ -0,0 +1,98 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+
+'use strict'
+
+const requestManager = require("../../core/request-manager");
+const secUtils = require('../../core/sec-utils');
+const { ATTHERATE, DOUBLE_DOLLAR, COLON } = require('../../core/constants');
+const lodash = require('lodash');
+const routeManager = require('../../core/route-manager');
+const API = require("../../../nr-security-api");
+const logger = API.getLogger();
+
+module.exports = function initialize(shim, director) {
+  const proto = director.Router.prototype
+
+  shim.wrap(proto, 'insert', function wrapParam(shim, fn) {
+    if (!shim.isFunction(fn)) {
+      return fn
+    }
+    return function wrappedParam() {
+      this.routeMethod = arguments[0]
+      return fn.apply(this, arguments);
+    }
+  })
+
+
+
+  shim.wrap(proto, 'mount', function wrapMount(shim, mount) {
+    if (!shim.isFunction(mount)) {
+      return mount
+    }
+    return function wrappedMount(routes) {
+      shim.wrap(routes, director.http.methods, function wrapRoute(shim, route) {
+        if (!shim.isFunction(route)) {
+          return route
+        }
+        return function wrappedRoute() {
+          extractParams(shim, arguments);
+          return route.apply(this, arguments);
+        }
+      })
+
+      if (arguments[1]) {
+        try {
+          const method = this.routeMethod ? this.routeMethod : Object.keys(arguments[0])[0];
+          const path = "/" + arguments[1].join('/')
+          const stakTrace = secUtils.traceElementForRoute();
+          const splittedStack = stakTrace[0].split(DOUBLE_DOLLAR);
+          const key = lodash.upperCase(method) + ATTHERATE + path;
+          routeManager.setRoute(key, splittedStack[0]);
+          if (path.includes(COLON)) {
+            const dummyKey = key.split(COLON)[0] + ":param_input";
+            routeManager.setRoute(dummyKey, splittedStack[0]);
+          }
+        } catch (error) {
+          logger.debug("Error in intercepting routes", error);
+        }
+      }
+      return mount.apply(this, arguments);
+    }
+  })
+}
+
+/**
+ * Utility function to prepare parameterMap
+ * @param {*} shim 
+ * @param {*} params 
+ */
+function extractParams(shim, params) {
+  const segment = shim.getActiveSegment();
+  if (segment && segment.transaction) {
+    let request = requestManager.getRequestFromId(segment.transaction.id);
+    if (params && request) {
+      Object.keys(params).forEach(function (key) {
+        if (params[key]) {
+          if (!request.parameterMap[key]) {
+            request.parameterMap[key] = new Array(params[key].toString());
+            requestManager.setRequest(segment.transaction.id, request);
+          }
+        }
+      });
+    }
+   
+    if (request) {
+      let uri = request.url.split("?")[0];
+      const param = Object.values(params)[0];
+      if (uri.includes(param)) {
+        uri = lodash.replace(uri, param, ':param_input');
+        request.uri  = uri;
+        requestManager.setRequest(segment.transaction.id, request);
+      }
+    }
+  }
+}

package/lib/instrumentation-security/hooks/express/nr-express.js

@@ -0,0 +1,106 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+'use strict'
+
+/**
+ * Express middleware generates traces where middleware are considered siblings
+ * (ended on 'next' invocation) and not nested. Middlware are nested below the
+ * routers they are mounted to.
+ */
+
+const requestManager = require("../../core/request-manager");
+const secUtils = require('../../core/sec-utils');
+const { ATTHERATE, DOUBLE_DOLLAR } = require('../../core/constants');
+const lodash = require('lodash');
+const routeManager = require('../../core/route-manager');
+const API = require("../../../nr-security-api");
+const logger = API.getLogger();
+
+module.exports = function initialize(shim, express, moduleName) {
+  logger.info("Instrumenting express")
+  if (!express || !express.Router) {
+    return false
+  }
+
+  if (express.Router.use) {
+    wrapExpress4(shim, express)
+  } else {
+    // wrapExpress3(shim, express)
+  }
+}
+
+/**
+ * Wrapper to hook express version 4.x route method
+ * @param {*} shim 
+ * @param {*} express 
+ */
+function wrapExpress4(shim, express) {
+  shim.wrap(express.Router, 'route', function wrapRoute(shim, fn) {
+    if (!shim.isFunction(fn)) {
+      return fn
+    }
+    return function wrappedRoute() {
+      try {
+        const stakTrace = secUtils.traceElementForRoute();
+        const splittedStack = stakTrace[0].split(DOUBLE_DOLLAR);
+        const key = lodash.upperCase(splittedStack[1]) + ATTHERATE + arguments[0];
+        routeManager.setRoute(key, splittedStack[0]);
+      } catch (error) {
+
+      }
+      const route = fn.apply(this, arguments)
+      return route;
+    }
+  })
+
+
+  //Wrapper to hook process_params method to extract out path param and query params.
+  shim.wrap(express.Router, 'process_params', function wrapParam(shim, fn) {
+    if (!shim.isFunction(fn)) {
+      return fn
+    }
+    return function wrappedParam() {
+      extractParams(shim, arguments[2]);
+      const route = fn.apply(this, arguments)
+      return route
+    }
+  })
+}
+/**
+ * Utility function to parse request obejct intercepted from express.router.process_params() method hook
+ * @param {*} shim 
+ * @param {*} req 
+ */
+function extractParams(shim, req) {
+  const segment = shim.getActiveSegment();
+  if (segment && segment.transaction) {
+    let request = requestManager.getRequestFromId(segment.transaction.id);
+    if (req.params && request) {
+      Object.keys(req.params).forEach(function (key) {
+        if (req.params[key]) {
+          if (!request.parameterMap[key]) {
+            request.parameterMap[key] = new Array(req.params[key].toString());
+            requestManager.setRequest(segment.transaction.id, request);
+          }
+        }
+      });
+    }
+    if (req.query && request) {
+      Object.keys(req.query).forEach(function (key) {
+        if (req.query[key]) {
+          if (!request.parameterMap[key]) {
+            request.parameterMap[key] = new Array(req.query[key].toString());
+            requestManager.setRequest(segment.transaction.id, request);
+          }
+        }
+      });
+    }
+    if (req.route && req.route.path && request) {
+      request.uri = req.route.path;
+      requestManager.setRequest(segment.transaction.id, request);
+    }
+  }
+}

package/lib/instrumentation-security/hooks/fastify/nr-fastify.js

@@ -0,0 +1,155 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+'use strict'
+const requestManager = require("../../core/request-manager");
+const secUtils = require('../../core/sec-utils');
+const { ATTHERATE, DOUBLE_DOLLAR } = require('../../core/constants');
+const lodash = require('lodash');
+const routeManager = require('../../core/route-manager');
+const semver = require('semver')
+const url = require('url');
+const API = require("../../../nr-security-api");
+const logger = API.getLogger();
+
+
+/**
+ * Sets up fastify route handler
+ *
+ * Fastify's onRoute hook will fire whenever
+ * a route is registered.  This is the most straight
+ * forward way to get at a fastify route definition.
+ * Not only are we _not_ relying on private implementations
+ * that could change, fastify is pretty good about protecting
+ * those private implementations from access, and getting
+ * at them would require a lot of gymnastics and hard to
+ * maintain code
+ *
+ * @param shim
+ * @param fastify
+ */
+const setupRouteHandler = (shim, fastify, moduleName) => {
+  logger.info("Instrumenting Fastify")
+
+  const VerbMethods = ['all', 'delete', 'get', 'head', 'post', 'put', 'patch', 'options'];
+  //for routeMap
+  VerbMethods.forEach(function (fun) {
+    shim.wrap(fastify, fun, function wrapRoute(shim, fn) {
+      if (!shim.isFunction(fn)) {
+        return fn
+      }
+      return function wrappedRoute() {
+        try {
+          const stakTrace = secUtils.traceElementForRoute();
+          const splittedStack = stakTrace[0].split(DOUBLE_DOLLAR);
+          const key = lodash.upperCase(splittedStack[1]) + ATTHERATE + arguments[0];
+          routeManager.setRoute(key, splittedStack[0]);
+        } catch (error) {
+        }
+        const route = fn.apply(this, arguments);
+        return route;
+      }
+    })
+  });
+
+  fastify.addHook('onRequest', async (request) => {
+    if (!requestManager.getRequest(shim)) {
+      secUtils.addRequestData(shim, request);
+    }
+    extractParams(shim, request);
+  })
+
+}
+
+
+module.exports = function initialize(shim, fastify, moduleName) {
+
+  const fastifyVersion = shim.require('./package.json').version
+  const isv3Plus = semver.satisfies(fastifyVersion, '>=3.0.0')
+
+  /**
+   * Fastify exports a function, so we need to use wrapExport
+   */
+  const wrappedExport = shim.wrapExport(fastify, function wrapFastifyModule(shim, fn) {
+    return function wrappedFastifyModule() {
+      // call original function get get fastify object (which is singleton-ish)
+      const fastifyForWrapping = fn.apply(this, arguments)
+
+      setupRouteHandler(shim, fastifyForWrapping, moduleName)
+
+      return fastifyForWrapping
+    }
+  })
+
+  if (isv3Plus) {
+    setupExports(fastify, wrappedExport)
+  }
+}
+
+
+
+
+/**
+ * module.exports = fastify
+ * module.exports.fastify = fastify
+ * module.exports.default = fastify
+ *
+ * @param original
+ * @param wrappedExport
+ */
+function setupExports(original, wrappedExport) {
+  wrappedExport.fastify = original.fastify
+
+  if (original.fastify) {
+    wrappedExport.fastify = wrappedExport
+  }
+
+  if (original.default) {
+    wrappedExport.default = wrappedExport
+  }
+}
+
+/**
+ * Utility to parse request object to get path params and query params
+ * @param {*} shim 
+ * @param {*} req 
+ */
+function extractParams(shim, req) {
+  try {
+    const reqURL = req.url || req.raw.url;
+    const parsedURI = url.parse(reqURL).pathname;
+    const segment = shim.getActiveSegment();
+    if (segment && segment.transaction) {
+      let request = requestManager.getRequestFromId(segment.transaction.id);
+      if (req.params && segment && request) {
+        Object.keys(req.params).forEach(function (key) {
+          if (req.params[key]) {
+            if (!request.parameterMap[key]) {
+              request.parameterMap[key] = new Array(req.params[key].toString());
+              requestManager.setRequest(segment.transaction.id, request);
+            }
+          }
+        });
+      }
+      if (req.query && request) {
+        Object.keys(req.query).forEach(function (key) {
+          if (req.query[key]) {
+            if (!request.parameterMap[key]) {
+              request.parameterMap[key] = new Array(req.query[key].toString());
+              requestManager.setRequest(segment.transaction.id, request);
+            }
+          }
+        });
+      }
+      let method = request.method.toUpperCase();
+      if (parsedURI && request && requestManager.requestMap[method + ATTHERATE + parsedURI]) {
+        request.uri = parsedURI;
+        requestManager.setRequest(segment.transaction.id, request);
+      }
+    }
+  } catch (error) {
+  }
+
+}