@newrelic/security-agent 0.1.1 → 0.1.3

package/CHANGELOG.md

@@ -1,4 +1,15 @@
-###v0.1.1
+### v0.1.3
+* Updated semver to v7.5.3 (Fix for CWE-1333)
+* Updated request-ip, log4js, html-entities, uuid and fast-safe-stringify to latest version.
+* Fix for system call event generation to avoid null parameters in event.
+* Fix for id in nr-csec-tracing-data.
+* WS logging update.
+
+### v0.1.2
+* bump @aws-sdk/client-lambda to v3.348.0
+* Minor fix in ws reconnect.
+
+### v0.1.1
 * Fix in mysql instrumentation on getConnection to check if callback is wrapped
 * NR-123832: Support for fire and forget vulnerability detection
 * Fixes for snapshot file.

package/THIRD_PARTY_NOTICES.md

@@ -75,7 +75,7 @@ code, the source code can be found at [https://github.com/newrelic/csec-node-age
 
 ### @aws-sdk/client-lambda
 
-This product includes source derived from [@aws-sdk/client-lambda](https://github.com/aws/aws-sdk-js-v3) ([v3.276.0](https://github.com/aws/aws-sdk-js-v3/tree/v3.276.0)), distributed under the [Apache-2.0 License](https://github.com/aws/aws-sdk-js-v3/blob/v3.276.0/LICENSE):
+This product includes source derived from [@aws-sdk/client-lambda](https://github.com/aws/aws-sdk-js-v3) ([v3.358.0](https://github.com/aws/aws-sdk-js-v3/tree/v3.358.0)), distributed under the [Apache-2.0 License](https://github.com/aws/aws-sdk-js-v3/blob/v3.358.0/LICENSE):
 
 ```
                                 Apache License
@@ -284,22 +284,34 @@ This product includes source derived from [@aws-sdk/client-lambda](https://githu
 
 ### axios
 
-This product includes source derived from [axios](https://github.com/axios/axios) ([v1.4.0](https://github.com/axios/axios/tree/v1.4.0)), distributed under the [MIT License](https://github.com/axios/axios/blob/v1.4.0/LICENSE):
+This product includes source derived from [axios](https://github.com/axios/axios) ([v0.21.4](https://github.com/axios/axios/tree/v0.21.4)), distributed under the [MIT License](https://github.com/axios/axios/blob/v0.21.4/LICENSE):
 
 ```
-# Copyright (c) 2014-present Matt Zabriskie & Collaborators
+Copyright (c) 2014-present Matt Zabriskie
 
-Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
 
-The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
 
 ```
 
 ### check-disk-space
 
-This product includes source derived from [check-disk-space](https://github.com/Alex-D/check-disk-space) ([v3.3.1](https://github.com/Alex-D/check-disk-space/tree/v3.3.1)), distributed under the [MIT License](https://github.com/Alex-D/check-disk-space/blob/v3.3.1/LICENSE):
+This product includes source derived from [check-disk-space](https://github.com/Alex-D/check-disk-space) ([v3.4.0](https://github.com/Alex-D/check-disk-space/tree/v3.4.0)), distributed under the [MIT License](https://github.com/Alex-D/check-disk-space/blob/v3.4.0/LICENSE):
 
 ```
 MIT License
@@ -421,10 +433,10 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 ### html-entities
 
-This product includes source derived from [html-entities](https://github.com/mdevils/node-html-entities) ([v1.4.0](https://github.com/mdevils/node-html-entities/tree/v1.4.0)), distributed under the [MIT License](https://github.com/mdevils/node-html-entities/blob/v1.4.0/LICENSE):
+This product includes source derived from [html-entities](https://github.com/mdevils/html-entities) ([v2.3.6](https://github.com/mdevils/html-entities/tree/v2.3.6)), distributed under the [MIT License](https://github.com/mdevils/html-entities/blob/v2.3.6/LICENSE):
 
 ```
-Copyright (c) 2013 Dulin Marat
+Copyright (c) 2021 Dulin Marat
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -443,6 +455,7 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
+
 ```
 
 ### is-invalid-path
@@ -627,7 +640,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 ### request-ip
 
-This product includes source derived from [request-ip](https://github.com/pbojinov/request-ip) ([v2.2.0](https://github.com/pbojinov/request-ip/tree/v2.2.0)), distributed under the [MIT License](https://github.com/pbojinov/request-ip/blob/v2.2.0/LICENSE.md):
+This product includes source derived from [request-ip](https://github.com/pbojinov/request-ip) ([v3.3.0](https://github.com/pbojinov/request-ip/tree/v3.3.0)), distributed under the [MIT License](https://github.com/pbojinov/request-ip/blob/v3.3.0/LICENSE.md):
 
 ```
 The MIT License (MIT)
@@ -671,7 +684,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 ### semver
 
-This product includes source derived from [semver](https://github.com/npm/node-semver) ([v6.3.0](https://github.com/npm/node-semver/tree/v6.3.0)), distributed under the [ISC License](https://github.com/npm/node-semver/blob/v6.3.0/LICENSE):
+This product includes source derived from [semver](https://github.com/npm/node-semver) ([v7.5.3](https://github.com/npm/node-semver/tree/v7.5.3)), distributed under the [ISC License](https://github.com/npm/node-semver/blob/v7.5.3/LICENSE):
 
 ```
 The ISC License
@@ -777,30 +790,18 @@ THE SOFTWARE.
 
 ### uuid
 
-This product includes source derived from [uuid](https://github.com/uuidjs/uuid) ([v3.4.0](https://github.com/uuidjs/uuid/tree/v3.4.0)), distributed under the [MIT License](https://github.com/uuidjs/uuid/blob/v3.4.0/LICENSE.md):
+This product includes source derived from [uuid](https://github.com/uuidjs/uuid) ([v9.0.0](https://github.com/uuidjs/uuid/tree/v9.0.0)), distributed under the [MIT License](https://github.com/uuidjs/uuid/blob/v9.0.0/LICENSE.md):
 
 ```
 The MIT License (MIT)
 
-Copyright (c) 2010-2016 Robert Kieffer and other contributors
+Copyright (c) 2010-2020 Robert Kieffer and other contributors
 
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
 
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ```
 
@@ -1839,7 +1840,7 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ### mongodb-memory-server
 
-This product includes source derived from [mongodb-memory-server](https://github.com/nodkz/mongodb-memory-server) ([v8.12.2](https://github.com/nodkz/mongodb-memory-server/tree/v8.12.2)), distributed under the [MIT License](https://github.com/nodkz/mongodb-memory-server/blob/v8.12.2/LICENSE.md):
+This product includes source derived from [mongodb-memory-server](https://github.com/nodkz/mongodb-memory-server) ([v8.13.0](https://github.com/nodkz/mongodb-memory-server/tree/v8.13.0)), distributed under the [MIT License](https://github.com/nodkz/mongodb-memory-server/blob/v8.13.0/LICENSE.md):
 
 ```
 The MIT License (MIT)
@@ -2064,7 +2065,7 @@ Apache License
 
 ### mongodb
 
-This product includes source derived from [mongodb](https://github.com/mongodb/node-mongodb-native) ([v3.7.3](https://github.com/mongodb/node-mongodb-native/tree/v3.7.3)), distributed under the [Apache-2.0 License](undefined):
+This product includes source derived from [mongodb](https://github.com/mongodb/node-mongodb-native) ([v3.7.4](https://github.com/mongodb/node-mongodb-native/tree/v3.7.4)), distributed under the [Apache-2.0 License](undefined):
 
 ```
 Apache License
@@ -2480,7 +2481,7 @@ Apache License
 
 ### newrelic
 
-This product includes source derived from [newrelic](https://github.com/newrelic/node-newrelic) ([v9.15.0](https://github.com/newrelic/node-newrelic/tree/v9.15.0)), distributed under the [Apache-2.0 License](https://github.com/newrelic/node-newrelic/blob/v9.15.0/LICENSE):
+This product includes source derived from [newrelic](https://github.com/newrelic/node-newrelic) ([v10.3.1](https://github.com/newrelic/node-newrelic/tree/v10.3.1)), distributed under the [Apache-2.0 License](https://github.com/newrelic/node-newrelic/blob/v10.3.1/LICENSE):
 
 ```
                                  Apache License
@@ -2777,7 +2778,7 @@ THE SOFTWARE
 
 ### sinon
 
-This product includes source derived from [sinon](https://github.com/sinonjs/sinon) ([v15.0.4](https://github.com/sinonjs/sinon/tree/v15.0.4)), distributed under the [BSD-3-Clause License](https://github.com/sinonjs/sinon/blob/v15.0.4/LICENSE):
+This product includes source derived from [sinon](https://github.com/sinonjs/sinon) ([v15.2.0](https://github.com/sinonjs/sinon/tree/v15.2.0)), distributed under the [BSD-3-Clause License](https://github.com/sinonjs/sinon/blob/v15.2.0/LICENSE):
 
 ```
 (The BSD License)
@@ -2812,7 +2813,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### tap
 
-This product includes source derived from [tap](https://github.com/tapjs/node-tap) ([v16.3.4](https://github.com/tapjs/node-tap/tree/v16.3.4)), distributed under the [ISC License](https://github.com/tapjs/node-tap/blob/v16.3.4/LICENSE):
+This product includes source derived from [tap](https://github.com/tapjs/node-tap) ([v16.3.7](https://github.com/tapjs/node-tap/tree/v16.3.7)), distributed under the [ISC License](https://github.com/tapjs/node-tap/blob/v16.3.7/LICENSE):
 
 ```
 The ISC License

package/lib/instrumentation-security/hooks/http/nr-http.js

@@ -135,10 +135,10 @@ function outboundHook(shim, mod, method, moduleName) {
         if (arguments[0] instanceof Object) {
           if (arguments[0] && arguments[0].headers && request.headers) {
             arguments[0].headers.SECHOOK = id;
-            arguments[0].headers[NRCSECTRACINGDATA] = traceHeader + appUUID + '/' + this.secEvent.apiId + '/' + id + ';';
+            arguments[0].headers[NRCSECTRACINGDATA] = traceHeader + appUUID + '/' + this.secEvent.apiId + '/' + this.secEvent.id + ';';
           } else {
             arguments[0].headers = {};
-            arguments[0].headers[NRCSECTRACINGDATA] = traceHeader + appUUID + '/' + this.secEvent.apiId + '/' + id + ';';
+            arguments[0].headers[NRCSECTRACINGDATA] = traceHeader + appUUID + '/' + this.secEvent.apiId + '/' + this.secEvent.id + ';';
             arguments[0].headers.SECHOOK = id;
           }
           if (request && request.headers[NR_CSEC_FUZZ_REQUEST_ID] && arguments[0].headers) {

package/lib/instrumentation-security/hooks/native/nr-childProcess.js

@@ -30,7 +30,7 @@ function execFileHook(shim, childProcess, moduleName) {
       const interceptedArgs = [arguments[0]];
       shim.interceptedArgs = interceptedArgs;
       const request = requestManager.getRequest(shim);
-      if (request) {
+      if (request && arguments[0]) {
         const traceObject = secUtils.getTraceObject(shim);
         const secMetadata = securityMetaData.getSecurityMetaData(request, interceptedArgs, traceObject, secUtils.getExecutionId(), EVENT_TYPE.SYSTEM_COMMAND, EVENT_CATEGORY.SYS)
         const secEvent = API.generateSecEvent(secMetadata);

package/lib/nr-security-agent/lib/core/commonUtils.js

@@ -5,7 +5,7 @@
 
 /* eslint-disable prefer-promise-reject-errors */
 const fs = require('fs');
-const uuidv4 = require('uuid/v4');
+const uuidV = require('uuid');
 const logs = require('./logging');
 const logger = logs.getLogger();
 const OS = require('os');
@@ -27,7 +27,7 @@ let websocketHealth;
  * @returns UUID
  */
 function getUUID(){
-    let uuid = process.env.applicationUUID || uuidv4();
+    let uuid = process.env.applicationUUID || uuidV.v4();
     process.env.applicationUUID = uuid;
     return uuid;
 }

package/lib/nr-security-agent/lib/core/connections/websocket/websocket.js

@@ -115,6 +115,12 @@ SecWebSocket.prototype.init = function init() {
     webSocket.on(WS_ON_ERR, this.errCB);
     webSocket.on(WS_ON_PONG, () => {
         lastPongtime = Date.now();
+        commonUtils.setWSHealthStatus('OK');
+        logger.debug("Pong received from Validator");
+    })
+    webSocket.on('close', () => {
+        commonUtils.setWSHealthStatus('Error');
+        logger.warn("WS connection closed");
     })
     this.instance = webSocket;
 };
@@ -310,6 +316,15 @@ const handleDispatchFailure = (self, event, eventStr) => {
  */
 const defaultOnOpenCB = () => async function onOpen() {
     const self = this;
+    lastPongtime = 0;
+
+    if (pingIntervalConst) {
+        clearInterval(pingIntervalConst);
+    }
+    pingIntervalConst = setInterval(() => {
+        self.pingWS();
+    }, 30000)
+
     if (self.isICReadyForEvents) {
         return;
     }
@@ -317,12 +332,7 @@ const defaultOnOpenCB = () => async function onOpen() {
         self.reconnect();
         return;
     }
-    if (pingIntervalConst) {
-        clearInterval(pingIntervalConst);
-    }
-    pingIntervalConst = setInterval(() => {
-        self.pingWS();
-    }, 30000)
+   
     const validatorService = commonUtils.getValidatorServiceEndpointURL();
     initLogger.info(`[STEP-4] => Web socket connection to SaaS validator established successfully at ${validatorService}`)
     try {
@@ -378,6 +388,8 @@ const defaultOnErrCB = () => function onClose(error) {
     commonUtils.setWSHealthStatus('Error');
     statusUtils.addErrortoBuffer(error);
     const self = this;
+    logger.error("Error while connecting to validator:",error.message)
+    logger.warn("Security Agent INACTIVE!!!")
     if (error && error.code && (error.code === 'ECONNREFUSED' || error.code === 'EPIPE' || error.code === 'ECONNRESET')) {
         logger.debug("WS Client Error callback called:", error);
         self.obeyReconnect();

package/lib/nr-security-agent/lib/core/xss-utils.js

@@ -4,13 +4,12 @@
  */
 
 const _ = require('lodash');
-const { AllHtmlEntities } = require('html-entities');
 const decode = require('unescape');
 const querystring = require('querystring');
 
 const { Agent } = require('./agent');
 
-const entities = new AllHtmlEntities();
+const htmlEntities = require('html-entities');
 
 const tagNameRegex = /<([a-zA-Z_-]+[0-9]*|!--)/gmi;
 const attribRegex = /([^(/\s<'">)]+?)(?:\s*)=\s*(('|")([\s\S]*?)(?:(?=(\\?))\5.)*?\3|.+?(?=\/>|>|\?>|\s|<\/|$))/gmi;
@@ -222,7 +221,7 @@ function getXSSConstructs (data) {
                 if (!_.isEmpty(key) && (upperCaseAttribKey.startsWith('ON') || upperCaseAttribKey === 'SRC' || upperCaseAttribKey === 'HREF' ||
                     upperCaseAttribKey === 'ACTION' || upperCaseAttribKey === 'FORMACTION' || upperCaseAttribKey === 'SRCDOC' ||
                     upperCaseAttribKey === 'DATA' || decode(val).toUpperCase().replace(/\s/g, '').includes('JAVASCRIPT:') ||
-                    entities.decode(val).toUpperCase().replace(/\s/g, '').includes('JAVASCRIPT:'))) {
+                    htmlEntities.decode(val).toUpperCase().replace(/\s/g, '').includes('JAVASCRIPT:'))) {
                     isAttackConstruct = true;
                 }
             } else {

package/lib/nr-security-agent/resources/config.js

@@ -11,8 +11,8 @@ if(process.platform == 'win32'){
     AGENT_DIR = path.join(__dirname, "..\\..\\..\\");
 }
 
-const uuidv4 = require('uuid/v4');
-process.env.applicationUUID = process.env.applicationUUID || uuidv4();
+const uuid = require('uuid');
+process.env.applicationUUID = process.env.applicationUUID || uuid.v4();
 
 module.exports = {
     AGENT_DIR,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@newrelic/security-agent",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "New Relic Security Agent for Node.js",
   "main": "index.js",
   "jsonVersion": "1.0.1",
@@ -35,27 +35,27 @@
     "url": "https://github.com/newrelic/csec-node-agent.git"
   },
   "dependencies": {
-    "@aws-sdk/client-lambda": "3.276.0",
+    "@aws-sdk/client-lambda": "^3.348.0",
     "axios": "0.21.4",
-    "check-disk-space": "^3.1.0",
-    "content-type": "^1.0.4",
-    "fast-safe-stringify": "^2.0.7",
+    "check-disk-space": "^3.4.0",
+    "content-type": "^1.0.5",
+    "fast-safe-stringify": "^2.1.1",
     "find-package-json": "^1.2.0",
     "hash.js": "^1.1.7",
-    "html-entities": "^1.2.1",
+    "html-entities": "^2.3.6",
     "is-invalid-path": "^1.0.2",
     "js-yaml": "^4.1.0",
-    "jsonschema": "^1.4.0",
+    "jsonschema": "^1.4.1",
     "lodash": "^4.17.21",
-    "log4js": "^6.0.0",
+    "log4js": "^6.9.1",
     "pretty-bytes": "^5.6.0",
-    "request-ip": "^2.1.3",
+    "request-ip": "^3.3.0",
     "ringbufferjs": "^2.0.0",
-    "semver": "^6.3.0",
+    "semver": "^7.5.3",
     "sync-request": "^6.1.0",
     "unescape": "^1.0.1",
     "unescape-js": "^1.1.4",
-    "uuid": "^3.4.0",
+    "uuid": "^9.0.0",
     "ws": "^7.5.9"
   },
   "devDependencies": {
@@ -81,7 +81,7 @@
     "mongodb-memory-server": "^8.11.2",
     "mongodb2": "npm:mongodb@^2.2.36",
     "mongodb3": "npm:mongodb@^3.7.3",
-    "newrelic": "^9.15.0",
+    "newrelic": "^10.3.1",
     "request": "^2.88.2",
     "restify": "^11.1.0",
     "sinon": "^15.0.0",