@newrelic/security-agent 0.0.1

package/lib/instrumentation-security/hooks/mysql/nr-mysql.js

@@ -0,0 +1,232 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+const requestManager = require("../../core/request-manager");
+
+const async_hooks = require("async_hooks");
+const secUtils = require('../../core/sec-utils');
+const API = require("../../../nr-security-api");
+const securityMetaData = require('../../core/security-metadata');
+const { EVENT_TYPE, EVENT_CATEGORY } = require('../../core/event-constants');
+const { NR_CSEC_FUZZ_REQUEST_ID } = require('../../core/constants');
+const logger = API.getLogger();
+
+module.exports = initialize;
+
+/**
+ * Entry point of mysql and msyql2 module hooks
+ * @param {*} shim 
+ * @param {*} mysql 
+ * @param {*} moduleName 
+ */
+function initialize(shim, mysql, moduleName) {
+  logger.info("Instrumenting", moduleName);
+  if (shim._moduleRoot.includes("mysql2")) {
+    promiseInitialize(shim, mysql, moduleName);
+  } else {
+    callbackInitialize(shim, mysql, moduleName);
+  }
+}
+
+/**
+ * Wrapper for mysql module hooks
+ * @param {*} shim 
+ * @param {*} mysql 
+ * @param {*} moduleName 
+ */
+function callbackInitialize(shim, mysql, moduleName) {
+  shim.__wrappedPoolConnection = false;
+
+  shim.wrapReturn(mysql, "createConnection", wrapCreateConnection);
+  function wrapCreateConnection(shim, fn, fnName, connection) {
+    if (wrapQueryable(shim, connection, false)) {
+      const connProto = Object.getPrototypeOf(connection);
+      shim.unwrap(mysql, "createConnection");
+    }
+  }
+
+  shim.wrapReturn(mysql, "createPool", wrapCreatePool);
+  function wrapCreatePool(shim, fn, fnName, pool) {
+    if (wrapQueryable(shim, pool, true) && wrapGetConnection(shim, pool)) {
+      shim.unwrap(mysql, "createPool");
+    }
+  }
+
+  shim.wrapReturn(mysql, "createPoolCluster", wrapCreatePoolCluster);
+  function wrapCreatePoolCluster(shim, fn, fnName, poolCluster) {
+    const proto = Object.getPrototypeOf(poolCluster);
+    shim.wrapReturn(proto, "of", wrapPoolClusterOf);
+    function wrapPoolClusterOf(shim, of, _n, poolNamespace) {
+      if (wrapGetConnection(shim, poolNamespace)) {
+        shim.unwrap(proto, "of");
+      }
+    }
+    if (wrapGetConnection(shim, poolCluster)) {
+      shim.unwrap(mysql, "createPoolCluster");
+    }
+  }
+}
+
+/**
+ * Wrapper for mysql2 module hooks
+ * @param {*} shim 
+ */
+function promiseInitialize(shim) {
+  const callbackAPI = shim.require("./index");
+  if (callbackAPI && !shim.isWrapped(callbackAPI.createConnection)) {
+    callbackInitialize(shim, callbackAPI);
+  }
+}
+
+/**
+ * Wrapper to hook connection obejct.
+ * @param {*} shim 
+ * @param {*} connectable 
+ * @returns 
+ */
+function wrapGetConnection(shim, connectable) {
+  if (
+    !connectable ||
+    !connectable.getConnection ||
+    shim.isWrapped(connectable.getConnection)
+  ) {
+    return false;
+  }
+
+  const proto = Object.getPrototypeOf(connectable);
+  shim.wrap(proto, "getConnection", function doWrapGetConnection(shim, fn) {
+    return function wrappedGetConnection() {
+      const args = shim.toArray(arguments);
+      const cbIdx = args.length - 1;
+
+      if (shim.isFunction(args[cbIdx]) && !shim.isWrapped(args[cbIdx])) {
+        let cb = args[cbIdx];
+        if (!shim.__wrappedPoolConnection) {
+          cb = shim.wrap(cb, wrapGetConnectionCallback);
+        }
+        args[cbIdx] = shim.bindSegment(cb);
+      }
+      return fn.apply(this, args);
+    };
+  });
+
+  return true;
+}
+
+function wrapGetConnectionCallback(shim, cb) {
+  return function wrappedGetConnectionCallback(err, conn) {
+    try {
+      if (!err && wrapQueryable(shim, conn, false)) {
+        // Leave getConnection wrapped in order to maintain TX state, but we can
+        // simplify the wrapping of its callback in future calls.
+        shim.__wrappedPoolConnection = true;
+      }
+    } catch (_err) { }
+    return cb.apply(this, arguments);
+  };
+}
+
+/**
+ * Wrapper to hook query function.
+ * @param {*} shim 
+ * @param {*} queryable 
+ * @param {*} isPoolQuery 
+ * @returns 
+ */
+function wrapQueryable(shim, queryable, isPoolQuery) {
+  if (!queryable || !queryable.query || shim.isWrapped(queryable.query)) {
+    return false;
+  }
+  const proto = Object.getPrototypeOf(queryable);
+  queryHook(shim, proto, "query", isPoolQuery);
+  if (queryable.execute) {
+    queryHook(shim, proto, "execute", isPoolQuery);
+  }
+  return true;
+}
+
+/**
+ * Utility to extract query from the intercepted args
+ * @param {*} shim 
+ * @param {*} args 
+ * @returns 
+ */
+function extractQueryArgs(shim, args) {
+  let rawQuery = "";
+  let param = [];
+
+  // Figure out the query parameter.
+  if (shim.isString(args[0])) {
+    // query(sql [, values], callback)
+    rawQuery = args[0];
+  } else {
+    // query(opts [, values], callback)
+    rawQuery = args[0].sql;
+  }
+  // Then determine the query values and callback parameters.
+  if (shim.isArray(args[1])) {
+    // query({opts|sql}, values, callback)
+    param = args[1];
+  }
+  else if (args[1] && typeof args[1] == 'object') {
+    param = args[1];
+    param =  Object.values(param)
+  }
+  return {
+    rawQuery: rawQuery,
+    param: param,
+  };
+}
+/**
+ * Wrapper to wrap query function.
+ * @param {*} shim 
+ * @param {*} mod 
+ * @param {*} method 
+ */
+function queryHook(shim, mod, method, isPoolQuery) {
+
+  shim.wrap(mod, method, function makeQueryWrapper(shim, fn) {
+    return function queryWrapper() {
+      const parameters = extractQueryArgs(shim, arguments);
+      shim.interceptedArgs = parameters;
+      const request = requestManager.getRequest(shim);
+      if (request && !isPoolQuery) {
+        const traceObject = secUtils.getTraceObject(shim);
+        traceObject.sourceMethod = method;
+        const secMetadata = securityMetaData.getSecurityMetaData(request, parameters, traceObject, secUtils.getExecutionId(), EVENT_TYPE.DB_COMMAND, EVENT_CATEGORY.MYSQL)
+        const secEvent = API.generateSecEvent(secMetadata);
+        API.sendEvent(secEvent);
+        if (request.headers[NR_CSEC_FUZZ_REQUEST_ID]) {
+          callbackHook(shim, arguments, arguments.length - 1, secEvent);
+        }
+      }
+      return fn.apply(this, arguments);
+    };
+  });
+}
+
+
+/**
+ * Callback hook to generate exit event
+ * @param {*} shim 
+ * @param {*} mod 
+ * @param {*} fun 
+ * @param {*} secEvent 
+ */
+function callbackHook(shim, mod, fun, secEvent) {
+  shim.secEvent = secEvent;
+  shim.wrap(mod, fun, function callbackWrapper(shim, fn) {
+    if (!shim.isFunction(fn)) {
+      return fn;
+    }
+    return function wrapper() {
+      if ((arguments[0] === null || arguments[0] === undefined) && shim.secEvent) {
+        API.generateExitEvent(shim.secEvent);
+        delete shim.secEvent;
+      }
+      return fn.apply(this, arguments);
+    }
+  })
+}

package/lib/instrumentation-security/hooks/native/nr-childProcess.js

@@ -0,0 +1,131 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+module.exports = initialize;
+const requestManager = require("../../core/request-manager");
+const secUtils = require("../../core/sec-utils");
+const API = require("../../../nr-security-api");
+const securityMetaData = require('../../core/security-metadata');
+const { EVENT_TYPE, EVENT_CATEGORY } = require('../../core/event-constants');
+const { NR_CSEC_FUZZ_REQUEST_ID } = require('../../core/constants');
+const logger = API.getLogger();
+
+function initialize(shim, childProcess, moduleName) {
+  logger.info('Instrumenting child_process');
+  execFileHook(shim, childProcess, moduleName);
+  spawnHook(shim, childProcess, moduleName);
+  spawnSyncHook(shim, process.binding("spawn_sync"), moduleName);
+}
+/**
+ * Wrapper to hook childProcess.execFile() 
+ * @param {*} shim 
+ * @param {*} childProcess 
+ * @param {*} moduleName 
+ */
+function execFileHook(shim, childProcess, moduleName) {
+  shim.wrap(childProcess, "execFile", function makeWrapper(shim, fn) {
+    return function wrapper() {
+      const interceptedArgs = [arguments[0]];
+      shim.interceptedArgs = interceptedArgs;
+      const request = requestManager.getRequest(shim);
+      if (request) {
+        const traceObject = secUtils.getTraceObject(shim);
+        const secMetadata = securityMetaData.getSecurityMetaData(request, interceptedArgs, traceObject, secUtils.getExecutionId(), EVENT_TYPE.SYSTEM_COMMAND, EVENT_CATEGORY.SYS)
+        const secEvent = API.generateSecEvent(secMetadata);
+        API.sendEvent(secEvent);
+        if (request.headers[NR_CSEC_FUZZ_REQUEST_ID]) {
+          callbackHook(shim, arguments, arguments.length - 1, secEvent);
+        }
+
+      }
+
+      return fn.apply(this, arguments);
+    };
+  });
+}
+
+/**
+ * Function to wrap childProcess.spawnSync()
+ * @param {*} shim 
+ * @param {*} childProcess 
+ * @param {*} moduleName 
+ */
+function spawnSyncHook(shim, childProcess, moduleName) {
+  shim.wrap(childProcess, "spawn", function makeWrapper(shim, fn) {
+    return function wrapper() {
+      const interceptedArgs = arguments[0].args;
+      shim.interceptedArgs = interceptedArgs;
+      const request = requestManager.getRequest(shim);
+      if (request) {
+        const traceObject = secUtils.getTraceObject(shim);
+        const secMetadata = securityMetaData.getSecurityMetaData(request, interceptedArgs, traceObject, secUtils.getExecutionId(), EVENT_TYPE.SYSTEM_COMMAND, EVENT_CATEGORY.SYS)
+        this.secEvent = API.generateSecEvent(secMetadata);
+        API.sendEvent(this.secEvent);
+      }
+      const result = fn.apply(this, arguments);
+     
+      if(result && result.status==0 && request && request.headers[NR_CSEC_FUZZ_REQUEST_ID]){
+        API.generateExitEvent(this.secEvent);
+        delete this.secEvent
+      }
+      return result;
+    };
+  });
+}
+
+/**
+ * Function to wrap childProcess.spawn()
+ * @param {*} shim 
+ * @param {*} childProcess 
+ * @param {*} moduleName 
+ */
+function spawnHook(shim, childProcess, moduleName) {
+  shim.wrap(childProcess, "spawn", function makeWrapper(shim, fn) {
+    return function wrapper() {
+      let param = [];
+      param.push(arguments[0]);
+      if (arguments[1]) {
+        param.push(arguments[1].toString());
+
+      }
+      const interceptedArgs = param;
+      shim.interceptedArgs = interceptedArgs;
+      const request = requestManager.getRequest(shim);
+      if (request) {
+        const traceObject = secUtils.getTraceObject(shim);
+        const secMetadata = securityMetaData.getSecurityMetaData(request, interceptedArgs, traceObject, secUtils.getExecutionId(), EVENT_TYPE.SYSTEM_COMMAND, EVENT_CATEGORY.SYS)
+        const secEvent = API.generateSecEvent(secMetadata);
+        API.sendEvent(secEvent);
+        if (request.headers[NR_CSEC_FUZZ_REQUEST_ID]) {
+          callbackHook(shim, arguments, arguments.length - 1, secEvent);
+        }
+      }
+      return fn.apply(this, arguments);
+    };
+  });
+}
+
+/**
+ * Callback hook to generate exit event
+ * @param {*} shim 
+ * @param {*} mod 
+ * @param {*} fun 
+ * @param {*} secEvent 
+ */
+function callbackHook(shim, mod, fun, secEvent) {
+  shim.secEvent = secEvent;
+  shim.wrap(mod, fun, function callbackWrapper(shim, fn) {
+    if (!shim.isFunction(fn)) {
+      return fn;
+    }
+    return function wrapper(secEvent) {
+      if ((arguments[0] === null || arguments[0] === undefined) && shim.secEvent) {
+        API.generateExitEvent(shim.secEvent);
+        delete shim.secEvent;
+      }
+      return fn.apply(this, arguments);
+    }
+  })
+}

package/lib/instrumentation-security/hooks/postgres/nr-postgres.js

@@ -0,0 +1,131 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+
+'use strict'
+
+const requestManager = require('../../core/request-manager');
+const secUtils = require('../../core/sec-utils');
+const API = require("../../../nr-security-api");
+const securityMetaData = require('../../core/security-metadata');
+const { EVENT_TYPE, EVENT_CATEGORY } = require('../../core/event-constants');
+const logger = API.getLogger();
+const { NR_CSEC_FUZZ_REQUEST_ID } = require('../../core/constants');
+
+module.exports = function initialize(shim, pgsql, moduleName) {
+  logger.info('Instrumenting '+ moduleName)
+  // allows for native wrapping to not happen if not necessary
+  // when env var is true
+  if (process.env.NODE_PG_FORCE_NATIVE) {
+    return instrumentPGNative(pgsql)
+  }
+
+  // wrapping for native
+  function instrumentPGNative(pg) {
+    shim.wrapReturn(pg, 'Client', clientFactoryWrapper)
+    shim.wrapClass(pg, 'Pool', { post: poolPostConstructor, es6: true })
+  }
+
+  function poolPostConstructor(shim) {
+    if (!shim.isWrapped(this.Client)) {
+      shim.wrapClass(this, 'Client', clientPostConstructor)
+    }
+  }
+
+  function clientFactoryWrapper(shim, fn, fnName, client) {
+    clientPostConstructor.call(client, shim)
+  }
+
+  function clientPostConstructor(shim) {
+    queryHook(shim, this, 'query');
+  }
+
+  // The pg module defines "native" getter which sets up the native client lazily
+  // (only when called).  We replace the getter, so that we can instrument the native
+  // client.  The original getter replaces itself with the instance of the native
+  // client, so only instrument if the getter exists (otherwise assume already
+  // instrumented).
+  const origGetter = pgsql.__lookupGetter__('native')
+  if (origGetter) {
+    delete pgsql.native
+    pgsql.__defineGetter__('native', function getNative() {
+      const temp = origGetter()
+      if (temp != null) {
+        instrumentPGNative(temp)
+      }
+      return temp
+    })
+  }
+
+  queryHook(shim, pgsql && pgsql.Client && pgsql.Client.prototype, 'query');
+}
+
+
+
+function queryHook(shim, mod, method){
+  shim.wrap(mod, method, function makeQueryWrapper(shim, fn){
+      return function queryWrapper(){
+          const request = requestManager.getRequest(shim);
+          const sqlArgs = [];
+            if (typeof arguments[0] === 'object') {
+                if ((arguments[0] && arguments[0].constructor && arguments[0].constructor.name == 'Cursor') || (arguments[0] && arguments[0].text && arguments[0].values)) {
+                    sqlArgs.push(arguments[0].text);
+                    if (Array.isArray(arguments[0].values)) {
+                        sqlArgs.push(arguments[0].values);
+                    }
+                } else if (arguments[0] && arguments[0].constructor && arguments[0].constructor.name == 'QueryStream' && arguments[0].cursor) {
+                    sqlArgs.push(arguments[0].cursor.text);
+                    if (Array.isArray(arguments[0].cursor.values)) {
+                        sqlArgs.push(arguments[0].cursor.values);
+                    }
+                }
+                else if(arguments[0] && arguments[0].text){
+                  sqlArgs.push(arguments[0].text);
+                }
+            } else {
+                for (let i = 0; i < arguments.length; i++) {
+                    if (typeof arguments[i] !== 'function') {
+                        sqlArgs.push(arguments[i]);
+                    }
+                }
+            }
+            shim.interceptedArgs = sqlArgs;
+          if (request) {
+            const traceObject =  secUtils.getTraceObject(shim);
+            const secMetadata = securityMetaData.getSecurityMetaData(request, sqlArgs, traceObject, secUtils.getExecutionId(), EVENT_TYPE.DB_COMMAND, EVENT_CATEGORY.POSTGRES)
+            const secEvent =  API.generateSecEvent(secMetadata);
+            API.sendEvent(secEvent);
+            if (request.headers[NR_CSEC_FUZZ_REQUEST_ID]) {
+              callbackHook(shim, arguments, arguments.length - 1, secEvent);
+            }
+          }
+          return fn.apply(this, arguments);
+      }
+  })
+
+}
+
+/**
+ * Callback hook to generate exit event
+ * @param {*} shim 
+ * @param {*} mod 
+ * @param {*} fun 
+ * @param {*} secEvent 
+ */
+function callbackHook(shim, mod, fun, secEvent) {
+  shim.secEvent = secEvent;
+  shim.wrap(mod, fun, function callbackWrapper(shim, fn) {
+    if (!shim.isFunction(fn)) {
+      return fn;
+    }
+    return function wrapper() {
+      if ((arguments[0] === null || arguments[0] === undefined) && shim.secEvent) {
+        API.generateExitEvent(shim.secEvent);
+        delete shim.secEvent;
+      }
+      return fn.apply(this, arguments);
+    }
+  })
+}

package/lib/instrumentation-security/hooks/require/nr-require.js

@@ -0,0 +1,93 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+const requestManager = require('../../core/request-manager');
+const secUtils = require("../../core/sec-utils");
+const API = require("../../../nr-security-api");
+const securityMetaData = require('../../core/security-metadata');
+const { EVENT_TYPE, EVENT_CATEGORY } = require('../../core/event-constants');
+const { STRING } = require('../../core/constants')
+const logger = API.getLogger();
+const Module = require('module');
+const refDirRegEx = /^(\.\/)|^(\.\.\/)/g;
+const path = require('path');
+const CSEC = 'nr-security-agent';
+
+/**
+ * Entry point for xpath module hook
+ * @param {*} shim 
+ * @param {*} mod 
+ * @param {*} moduleName 
+ */
+function initialize(shim) {
+
+    const original_load = Module._load;
+    logger.info('Instrumenting Module._load');
+
+    Module._load = function (request, parent) {
+
+        let moduleName = arguments[0];
+
+        if (arguments[0].match(refDirRegEx) && arguments[1] && arguments[1].path) {
+            moduleName = path.resolve(arguments[1].path, arguments[0]);
+        }
+
+        let flag = false;
+        if (moduleName && typeof (moduleName) === STRING && !moduleName.includes(CSEC)) {
+            flag = true;
+        }
+        else if (parent && parent.id && typeof (parent.id) === STRING && moduleName.includes(CSEC) && parent.id.includes(CSEC)) {
+            flag = false;
+        }
+        else if (parent && parent.id && moduleName && typeof (moduleName) === STRING && moduleName.includes(CSEC) && parent.id.includes(CSEC)) {
+            flag = false;
+        }
+        if (flag) {
+            requireHook(shim, moduleName, parent);
+        }
+
+        return original_load.apply(this, arguments);
+
+    }
+
+}
+
+function requireHook(shim, moduleName, parent) {
+    try {
+        let request = requestManager.getRequest(shim);
+        let fallback = false;
+        if (!request) {
+            fallback = true;
+            let values = [...requestManager.requestMap.values()];
+            if (values.length > 0) {
+                request = values[values.length - 1];
+            }
+        }
+        if (request) {
+            const interceptedArgs = [moduleName];
+            let traceObject;
+            if (!fallback) {
+                traceObject = secUtils.getTraceObject(shim);
+            }
+            else {
+                traceObject = secUtils.getTraceObjectFallback(request);
+            }
+            const secMetadata = securityMetaData.getSecurityMetaData(request, interceptedArgs, traceObject, secUtils.getExecutionId(), EVENT_TYPE.FILE_OPERATION, EVENT_CATEGORY.FILE)
+            const secEvent = API.generateSecEvent(secMetadata);
+            API.sendEvent(secEvent);
+        }
+    } catch (error) {
+
+    }
+
+
+
+}
+
+
+module.exports = {
+    initialize
+}
+

package/lib/instrumentation-security/hooks/restify/nr-restify.js

@@ -0,0 +1,104 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+module.exports = initialize
+const requestManager = require('../../core/request-manager');
+const secUtils = require('../../core/sec-utils');
+const { ATTHERATE, DOUBLE_DOLLAR } = require('../../core/constants');
+const lodash = require('lodash');
+const routeManager = require('../../core/route-manager');
+const url = require('url');
+const API = require("../../../nr-security-api");
+const logger = API.getLogger();
+
+/**
+ * Entry point of restify module hook.
+ * Wrapper for registryRadix module 
+ * @param {*} shim 
+ * @param {*} mod 
+ * @param {*} moduleName 
+ */
+function initialize(shim, mod, moduleName) {
+    logger.info('Instrumenting Restify');
+    try {
+        const registryRadix = shim.require("./lib/routerRegistryRadix");
+
+        //routerRadix hook
+        shim.wrap(registryRadix && registryRadix.prototype, 'add', function makeWrapper(shim, fn) {
+            return function wrapper() {
+                if (arguments[0]) {
+                    try {
+                        const method = lodash.upperCase(arguments[0].method);
+                        const path = arguments[0].path;
+                        const key = method + ATTHERATE + path;
+                        const stakTrace = secUtils.traceElementForRoute();
+                        const splittedStack = stakTrace[0].split(DOUBLE_DOLLAR);
+                        routeManager.setRoute(key, splittedStack[0]);
+                    } catch (error) {
+
+                    }
+                }
+                return fn.apply(this, arguments);
+            }
+        })
+
+        const router = shim.require("./lib/router");
+
+        shim.wrap(router && router.prototype, 'lookup', function lookupWrapper(shim, fn) {
+            return function wrappedLookup() {
+                const result = fn.apply(this, arguments);
+                extractParams(shim, arguments[0]);
+                return result;
+            }
+        })
+    } catch (error) {
+    }
+
+}
+
+/**
+ * Utilty to extract path params and query params  
+ * @param {*} shim 
+ * @param {*} req 
+ */
+function extractParams(shim, req) {
+    const segment = shim.getActiveSegment();
+    if (segment && segment.transaction) {
+
+        let request = requestManager.getRequestFromId(segment.transaction.id);
+        if (req.params && request) {
+            try {
+                Object.keys(req.params).forEach(function (key) {
+                    if (req.params[key]) {
+                        if (!request.parameterMap[key]) {
+                            request.parameterMap[key] = new Array(req.params[key].toString());
+                            requestManager.setRequest(segment.transaction.id, request);
+                        }
+                    }
+                });
+            } catch (error) {
+
+            }
+        }
+        if (req.query && request) {
+            try {
+                const url_parts = url.parse(req.url, true);
+                const query = url_parts.query;
+                Object.keys(query).forEach(function (key) {
+                    if (query[key]) {
+                        request.parameterMap[key] = new Array(query[key].toString());
+                        requestManager.setRequest(segment.transaction.id, request);
+                    }
+                });
+            } catch (error) {
+
+            }
+        }
+        if (req.route && req.route.path && request) {
+            request.uri = req.route.path;
+            requestManager.setRequest(segment.transaction.id, request);
+        }
+    }
+}