@newrelic/security-agent 0.1.2 → 0.2.0

package/CHANGELOG.md

@@ -1,3 +1,18 @@
+### v0.2.0 (2023-07-24)
+#### Features
+* IAST data pull implementation
+* Logging update
+
+#### Bug Fixes
+* Param fixes for mysql and file hooks.
+
+### v0.1.3
+* Updated semver to v7.5.3 (Fix for CWE-1333)
+* Updated request-ip, log4js, html-entities, uuid and fast-safe-stringify to latest version.
+* Fix for system call event generation to avoid null parameters in event.
+* Fix for id in nr-csec-tracing-data.
+* WS logging update.
+
 ### v0.1.2
 * bump @aws-sdk/client-lambda to v3.348.0
 * Minor fix in ws reconnect.

package/THIRD_PARTY_NOTICES.md

@@ -75,7 +75,7 @@ code, the source code can be found at [https://github.com/newrelic/csec-node-age
 
 ### @aws-sdk/client-lambda
 
-This product includes source derived from [@aws-sdk/client-lambda](https://github.com/aws/aws-sdk-js-v3) ([v3.348.0](https://github.com/aws/aws-sdk-js-v3/tree/v3.348.0)), distributed under the [Apache-2.0 License](https://github.com/aws/aws-sdk-js-v3/blob/v3.348.0/LICENSE):
+This product includes source derived from [@aws-sdk/client-lambda](https://github.com/aws/aws-sdk-js-v3) ([v3.358.0](https://github.com/aws/aws-sdk-js-v3/tree/v3.358.0)), distributed under the [Apache-2.0 License](https://github.com/aws/aws-sdk-js-v3/blob/v3.358.0/LICENSE):
 
 ```
                                 Apache License
@@ -311,7 +311,7 @@ THE SOFTWARE.
 
 ### check-disk-space
 
-This product includes source derived from [check-disk-space](https://github.com/Alex-D/check-disk-space) ([v3.3.1](https://github.com/Alex-D/check-disk-space/tree/v3.3.1)), distributed under the [MIT License](https://github.com/Alex-D/check-disk-space/blob/v3.3.1/LICENSE):
+This product includes source derived from [check-disk-space](https://github.com/Alex-D/check-disk-space) ([v3.4.0](https://github.com/Alex-D/check-disk-space/tree/v3.4.0)), distributed under the [MIT License](https://github.com/Alex-D/check-disk-space/blob/v3.4.0/LICENSE):
 
 ```
 MIT License
@@ -433,10 +433,10 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 ### html-entities
 
-This product includes source derived from [html-entities](https://github.com/mdevils/node-html-entities) ([v1.4.0](https://github.com/mdevils/node-html-entities/tree/v1.4.0)), distributed under the [MIT License](https://github.com/mdevils/node-html-entities/blob/v1.4.0/LICENSE):
+This product includes source derived from [html-entities](https://github.com/mdevils/html-entities) ([v2.3.6](https://github.com/mdevils/html-entities/tree/v2.3.6)), distributed under the [MIT License](https://github.com/mdevils/html-entities/blob/v2.3.6/LICENSE):
 
 ```
-Copyright (c) 2013 Dulin Marat
+Copyright (c) 2021 Dulin Marat
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -455,6 +455,7 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
+
 ```
 
 ### is-invalid-path
@@ -639,7 +640,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 ### request-ip
 
-This product includes source derived from [request-ip](https://github.com/pbojinov/request-ip) ([v2.2.0](https://github.com/pbojinov/request-ip/tree/v2.2.0)), distributed under the [MIT License](https://github.com/pbojinov/request-ip/blob/v2.2.0/LICENSE.md):
+This product includes source derived from [request-ip](https://github.com/pbojinov/request-ip) ([v3.3.0](https://github.com/pbojinov/request-ip/tree/v3.3.0)), distributed under the [MIT License](https://github.com/pbojinov/request-ip/blob/v3.3.0/LICENSE.md):
 
 ```
 The MIT License (MIT)
@@ -683,7 +684,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 ### semver
 
-This product includes source derived from [semver](https://github.com/npm/node-semver) ([v6.3.0](https://github.com/npm/node-semver/tree/v6.3.0)), distributed under the [ISC License](https://github.com/npm/node-semver/blob/v6.3.0/LICENSE):
+This product includes source derived from [semver](https://github.com/npm/node-semver) ([v7.5.3](https://github.com/npm/node-semver/tree/v7.5.3)), distributed under the [ISC License](https://github.com/npm/node-semver/blob/v7.5.3/LICENSE):
 
 ```
 The ISC License
@@ -789,30 +790,18 @@ THE SOFTWARE.
 
 ### uuid
 
-This product includes source derived from [uuid](https://github.com/uuidjs/uuid) ([v3.4.0](https://github.com/uuidjs/uuid/tree/v3.4.0)), distributed under the [MIT License](https://github.com/uuidjs/uuid/blob/v3.4.0/LICENSE.md):
+This product includes source derived from [uuid](https://github.com/uuidjs/uuid) ([v9.0.0](https://github.com/uuidjs/uuid/tree/v9.0.0)), distributed under the [MIT License](https://github.com/uuidjs/uuid/blob/v9.0.0/LICENSE.md):
 
 ```
 The MIT License (MIT)
 
-Copyright (c) 2010-2016 Robert Kieffer and other contributors
+Copyright (c) 2010-2020 Robert Kieffer and other contributors
 
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
 
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ```
 
@@ -1851,7 +1840,7 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ### mongodb-memory-server
 
-This product includes source derived from [mongodb-memory-server](https://github.com/nodkz/mongodb-memory-server) ([v8.12.2](https://github.com/nodkz/mongodb-memory-server/tree/v8.12.2)), distributed under the [MIT License](https://github.com/nodkz/mongodb-memory-server/blob/v8.12.2/LICENSE.md):
+This product includes source derived from [mongodb-memory-server](https://github.com/nodkz/mongodb-memory-server) ([v8.13.0](https://github.com/nodkz/mongodb-memory-server/tree/v8.13.0)), distributed under the [MIT License](https://github.com/nodkz/mongodb-memory-server/blob/v8.13.0/LICENSE.md):
 
 ```
 The MIT License (MIT)
@@ -2076,7 +2065,7 @@ Apache License
 
 ### mongodb
 
-This product includes source derived from [mongodb](https://github.com/mongodb/node-mongodb-native) ([v3.7.3](https://github.com/mongodb/node-mongodb-native/tree/v3.7.3)), distributed under the [Apache-2.0 License](undefined):
+This product includes source derived from [mongodb](https://github.com/mongodb/node-mongodb-native) ([v3.7.4](https://github.com/mongodb/node-mongodb-native/tree/v3.7.4)), distributed under the [Apache-2.0 License](undefined):
 
 ```
 Apache License
@@ -2492,7 +2481,7 @@ Apache License
 
 ### newrelic
 
-This product includes source derived from [newrelic](https://github.com/newrelic/node-newrelic) ([v9.15.0](https://github.com/newrelic/node-newrelic/tree/v9.15.0)), distributed under the [Apache-2.0 License](https://github.com/newrelic/node-newrelic/blob/v9.15.0/LICENSE):
+This product includes source derived from [newrelic](https://github.com/newrelic/node-newrelic) ([v10.3.1](https://github.com/newrelic/node-newrelic/tree/v10.3.1)), distributed under the [Apache-2.0 License](https://github.com/newrelic/node-newrelic/blob/v10.3.1/LICENSE):
 
 ```
                                  Apache License
@@ -2789,7 +2778,7 @@ THE SOFTWARE
 
 ### sinon
 
-This product includes source derived from [sinon](https://github.com/sinonjs/sinon) ([v15.0.4](https://github.com/sinonjs/sinon/tree/v15.0.4)), distributed under the [BSD-3-Clause License](https://github.com/sinonjs/sinon/blob/v15.0.4/LICENSE):
+This product includes source derived from [sinon](https://github.com/sinonjs/sinon) ([v15.2.0](https://github.com/sinonjs/sinon/tree/v15.2.0)), distributed under the [BSD-3-Clause License](https://github.com/sinonjs/sinon/blob/v15.2.0/LICENSE):
 
 ```
 (The BSD License)
@@ -2824,7 +2813,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ### tap
 
-This product includes source derived from [tap](https://github.com/tapjs/node-tap) ([v16.3.4](https://github.com/tapjs/node-tap/tree/v16.3.4)), distributed under the [ISC License](https://github.com/tapjs/node-tap/blob/v16.3.4/LICENSE):
+This product includes source derived from [tap](https://github.com/tapjs/node-tap) ([v16.3.7](https://github.com/tapjs/node-tap/tree/v16.3.7)), distributed under the [ISC License](https://github.com/tapjs/node-tap/blob/v16.3.7/LICENSE):
 
 ```
 The ISC License

package/lib/instrumentation-security/core/constants.js

@@ -60,7 +60,6 @@ module.exports = {
     SLASHDOTDOT: '/..',
     UNDEFINED: 'undefined',
     SELF_FD_PATH: '/proc/self/fd/',
-    CSEC_LAST_FUZZ_REQUEST_TIME: 'CSEC_LAST_FUZZ_REQUEST_TIME',
     NR_CSEC_FUZZ_REQUEST_ID: 'nr-csec-fuzz-request-id',
 
 };

package/lib/instrumentation-security/hooks/fs/nr-fs.js

@@ -16,6 +16,7 @@ const logger = API.getLogger();
 const { STRING, QUESTIONMARK, DOTDOTSLASH, UNDEFINED, SELF_FD_PATH, SLASH, SLASHDOTDOT, NR_CSEC_FUZZ_REQUEST_ID } = require('../../core/constants');
 const fsConsts = process.binding('constants').fs;
 const agentModule = API.getSecAgent();
+const lodash = require('lodash');
 
 const requireHook = require('../require/nr-require');
 
@@ -127,7 +128,7 @@ function openHook(shim, mod, moduleName) {
           parameters[0] = arguments[0];
         }
       }
-      if (request && typeof parameters[0] === STRING) {
+      if (request && typeof parameters[0] === STRING && !lodash.isEmpty(parameters[0]) ) {
         const policy = API.getPolicy();
         const dynamicScanningFlag = policy.data ? policy.data.vulnerabilityScan.iastScan.enabled : false;
         const url = request.url;
@@ -180,7 +181,7 @@ function probableToFAHooks(shim, mod, moduleName) {
         const interceptedArgs = [arguments[0]];
         shim.interceptedArgs = interceptedArgs;
         const request = requestManager.getRequest(shim);
-        if (request && typeof arguments[0] === STRING) {
+        if (request && typeof arguments[0] === STRING  && !lodash.isEmpty(arguments[0])) {
           const traceObject = secUtils.getTraceObject(shim);
           const secMetadata = securityMetaData.getSecurityMetaData(request, interceptedArgs, traceObject, secUtils.getExecutionId(), EVENT_TYPE.FILE_OPERATION, EVENT_CATEGORY.FILE)
           this.secEvent = API.generateSecEvent(secMetadata);
@@ -209,7 +210,7 @@ function probableToFIHooks(shim, mod, moduleName) {
         const interceptedArgs = [arguments[0]];
         shim.interceptedArgs = interceptedArgs;
         const request = requestManager.getRequest(shim);
-        if (request && typeof arguments[0] === STRING) {
+        if (request && typeof arguments[0] === STRING  && !lodash.isEmpty(arguments[0])) {
           const traceObject = secUtils.getTraceObject(shim);
           if (fun === COPY_FILE || fun === RENAME) {
             const secMetadata = securityMetaData.getSecurityMetaData(request, arguments[1], traceObject, secUtils.getExecutionId(), getCase(arguments[1]), EVENT_CATEGORY.FILE)
@@ -243,7 +244,7 @@ function probablePromiseToFAHooks(shim, mod, moduleName) {
         const interceptedArgs = [arguments[0]];
         shim.interceptedArgs = interceptedArgs;
         const request = requestManager.getRequest(shim);
-        if (request && typeof arguments[0] === STRING) {
+        if (request && typeof arguments[0] === STRING  && !lodash.isEmpty(arguments[0])) {
           const traceObject = secUtils.getTraceObject(shim);
           const secMetadata = securityMetaData.getSecurityMetaData(request, interceptedArgs, traceObject, secUtils.getExecutionId(), EVENT_TYPE.FILE_OPERATION, EVENT_CATEGORY.FILE)
           this.secEvent = API.generateSecEvent(secMetadata);
@@ -268,7 +269,7 @@ function probablePromiseToFIHooks(shim, mod, moduleName) {
         const interceptedArgs = [arguments[0]];
         shim.interceptedArgs = interceptedArgs;
         const request = requestManager.getRequest(shim);
-        if (request && typeof arguments[0] === STRING) {
+        if (request && typeof arguments[0] === STRING  && !lodash.isEmpty(arguments[0])) {
           const traceObject = secUtils.getTraceObject(shim);
           if (fun === COPY_FILE || fun === RENAME) {
             const secMetadata = securityMetaData.getSecurityMetaData(request, arguments[1], traceObject, secUtils.getExecutionId(), getCase(arguments[1]), EVENT_CATEGORY.FILE)

package/lib/instrumentation-security/hooks/http/nr-http.js

@@ -135,10 +135,10 @@ function outboundHook(shim, mod, method, moduleName) {
         if (arguments[0] instanceof Object) {
           if (arguments[0] && arguments[0].headers && request.headers) {
             arguments[0].headers.SECHOOK = id;
-            arguments[0].headers[NRCSECTRACINGDATA] = traceHeader + appUUID + '/' + this.secEvent.apiId + '/' + id + ';';
+            arguments[0].headers[NRCSECTRACINGDATA] = traceHeader + appUUID + '/' + this.secEvent.apiId + '/' + this.secEvent.id + ';';
           } else {
             arguments[0].headers = {};
-            arguments[0].headers[NRCSECTRACINGDATA] = traceHeader + appUUID + '/' + this.secEvent.apiId + '/' + id + ';';
+            arguments[0].headers[NRCSECTRACINGDATA] = traceHeader + appUUID + '/' + this.secEvent.apiId + '/' + this.secEvent.id + ';';
             arguments[0].headers.SECHOOK = id;
           }
           if (request && request.headers[NR_CSEC_FUZZ_REQUEST_ID] && arguments[0].headers) {

package/lib/instrumentation-security/hooks/mysql/nr-mysql.js

@@ -171,6 +171,19 @@ function wrapQueryable(shim, queryable, isPoolQuery) {
   }
   return true;
 }
+/**
+ * Utility to check list contains only string
+ * @param {*} list 
+ * @returns 
+ */
+function containsOnlyStrings(list) {
+  for (let i = 0; i < list.length; i++) {
+    if (typeof list[i] !== 'string') {
+      return false;
+    }
+  }
+  return true;
+}
 
 /**
  * Utility to extract query from the intercepted args
@@ -199,6 +212,9 @@ function extractQueryArgs(shim, args) {
     param = args[1];
     param =  Object.values(param)
   }
+  if(!containsOnlyStrings(param)){
+    param = [];
+  }
   return {
     rawQuery: rawQuery,
     param: param,

package/lib/instrumentation-security/hooks/native/nr-childProcess.js

@@ -30,7 +30,7 @@ function execFileHook(shim, childProcess, moduleName) {
       const interceptedArgs = [arguments[0]];
       shim.interceptedArgs = interceptedArgs;
       const request = requestManager.getRequest(shim);
-      if (request) {
+      if (request && arguments[0]) {
         const traceObject = secUtils.getTraceObject(shim);
         const secMetadata = securityMetaData.getSecurityMetaData(request, interceptedArgs, traceObject, secUtils.getExecutionId(), EVENT_TYPE.SYSTEM_COMMAND, EVENT_CATEGORY.SYS)
         const secEvent = API.generateSecEvent(secMetadata);

package/lib/instrumentation-security/hooks/require/nr-require.js

@@ -14,9 +14,11 @@ const Module = require('module');
 const refDirRegEx = /^(\.\/)|^(\.\.\/)/g;
 const path = require('path');
 const CSEC = 'nr-security-agent';
+const FN_INSPECT = '@contrast/fn-inspect';
+const NEWRELIC = 'newrelic';
 
 /**
- * Entry point for xpath module hook
+ * Entry point for require module hook
  * @param {*} shim 
  * @param {*} mod 
  * @param {*} moduleName 
@@ -33,17 +35,22 @@ function initialize(shim) {
         if (arguments[0].match(refDirRegEx) && arguments[1] && arguments[1].path) {
             moduleName = path.resolve(arguments[1].path, arguments[0]);
         }
-
+        
         let flag = false;
-        if (moduleName && typeof (moduleName) === STRING && !moduleName.includes(CSEC)) {
+        if (moduleName && typeof (moduleName) === STRING && !moduleName.includes(CSEC) && !moduleName.includes(FN_INSPECT)) {
             flag = true;
         }
-        else if (parent && parent.id && typeof (parent.id) === STRING && moduleName.includes(CSEC) && parent.id.includes(CSEC)) {
+        else if (parent && parent.id && typeof (parent.id) === STRING && moduleName.includes(CSEC) && parent.id.includes(CSEC) && moduleName.includes(FN_INSPECT)) {
             flag = false;
         }
-        else if (parent && parent.id && moduleName && typeof (moduleName) === STRING && moduleName.includes(CSEC) && parent.id.includes(CSEC)) {
+        else if (parent && parent.id && moduleName && typeof (moduleName) === STRING && moduleName.includes(CSEC) && parent.id.includes(CSEC) && moduleName.includes(FN_INSPECT)) {
             flag = false;
         }
+
+        if ((parent && parent.id && typeof (parent.id) === STRING && parent.id.includes(NEWRELIC)) ||  moduleName.includes(NEWRELIC)){
+            flag = false;
+        }
+
         if (flag) {
             requireHook(shim, moduleName, parent);
         }

package/lib/nr-security-agent/lib/core/Auth-headers.js

@@ -31,6 +31,7 @@ function AuthHeaders() {
         authHeaders['NR-CSEC-BUILD-NUMBER'] = appInfo.buildNumber;
         authHeaders['NR-ACCOUNT-ID'] =  NRAgent.config.account_id;
         authHeaders['NR-LICENSE-KEY'] = NRAgent ? NRAgent.config.license_key : '';
+        authHeaders["NR-CSEC-IAST-DATA-TRANSFER-MODE"] = "PULL";
     } catch (error) {
         logger.error("Exception in preparing auth headers:", error);
     }

package/lib/nr-security-agent/lib/core/applicationinfo.js

@@ -200,7 +200,7 @@ ApplicationInfo.prototype.updateSHAAndSize = async function updateSHAAndSize (Gl
     applicationInfo.sha256 = await shaSizeUtil.getSHA256ForFile(process.argv[0]);
 
     let stat = {};
-    if (process.hasWorker) {
+    if (commonUtils.hasWorker()) {
         stat = await getApplicationSHAAndSizeFromWorker(applicationInfo, application.deployedPath);
     } else {
         stat = await shaSizeUtil.getApplicationSHAAndSize(application.deployedPath, GlobalPromise);

package/lib/nr-security-agent/lib/core/commonUtils.js

@@ -5,7 +5,7 @@
 
 /* eslint-disable prefer-promise-reject-errors */
 const fs = require('fs');
-const uuidv4 = require('uuid/v4');
+const uuidV = require('uuid');
 const logs = require('./logging');
 const logger = logs.getLogger();
 const OS = require('os');
@@ -27,7 +27,7 @@ let websocketHealth;
  * @returns UUID
  */
 function getUUID(){
-    let uuid = process.env.applicationUUID || uuidv4();
+    let uuid = process.env.applicationUUID || uuidV.v4();
     process.env.applicationUUID = uuid;
     return uuid;
 }
@@ -55,8 +55,14 @@ function getKindIdPair (identifier, hostId) {
  * @returns 
  */
 function hasWorker () {
-    process.hasWorker = false;
-    return process.hasWorker;
+    let workerFlag = false;
+    try {
+        require('worker_threads');
+        workerFlag = true;
+    } catch (error) {
+        workerFlag = false;
+    }
+    return workerFlag;
 }
 
 function runtimeSupportsFunctionGenerators () {
@@ -136,13 +142,6 @@ function createDirectories () {
  */
 async function initialSetup () {
     try {
-        checkDiskSpace(`${CSEC_HOME}`).then((diskSpace) => {
-            if (diskSpace.free < 1000000000) {
-                logger.error(LOG_MESSAGES.AVAIL_DISK_ERROR, `${CSEC_HOME}`, prettyBytes(diskSpace.free));
-                process.exit();
-            }
-        }).catch(() => {
-        });
         createDirectories();
     } catch (err) {
         logger.error(err);
@@ -329,7 +328,8 @@ function logRollOver () {
             return;
         }
     } catch (error) {
-        logger.error('Error in getting stats of log file:', error);
+        logger.debug('Error in getting stats of log file:', error.message);
+        return;
     }
 
     try {

package/lib/nr-security-agent/lib/core/connections/websocket/index.js

@@ -6,9 +6,6 @@
 const {
     SecWebSocket,
     WSCallbacks,
-    aquireWebSocket,
-    isWebSocketBusy,
-    releaseWebSocket,
     setWebSocketConn
 } = require('./websocket');
 
@@ -17,9 +14,6 @@ const ResponseHandler = require('./response');
 module.exports = {
     SecWebSocket,
     WSCallbacks,
-    aquireWebSocket,
-    isWebSocketBusy,
-    releaseWebSocket,
     setWebSocketConn,
     ResponseHandler
 };

package/lib/nr-security-agent/lib/core/connections/websocket/response/IASTUtils.js

@@ -0,0 +1,50 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: New Relic Pre-Release
+ */
+const { Agent } = require('../../../agent');
+let completedRequestIds = new Set();
+const PolicyManager = require('../../../Policy');
+let batchSize;
+const batchthreshold = 300;
+function getCompletedRequestIds() {
+    return [...completedRequestIds];
+}
+
+function addRequestId(id) {
+    completedRequestIds.add(id);
+}
+
+function removeRequestId(id) {
+    completedRequestIds.delete(id);
+}
+
+function generateIASTDataRequest() {
+    const policyInstance = PolicyManager.getInstance();
+    if (policyInstance.data && policyInstance.data.vulnerabilityScan && policyInstance.data.vulnerabilityScan.iastScan) {
+        batchSize = batchSize ? batchSize : policyInstance.data.vulnerabilityScan.iastScan.probing.batchSize;
+        if (batchSize > batchthreshold) {
+            batchSize = policyInstance.data.vulnerabilityScan.iastScan.probing.batchSize;
+        }
+    }
+    if (getCompletedRequestIds().length >= batchSize || batchSize < batchthreshold) {
+        batchSize = (2 * batchSize);
+    }
+    let object = {};
+    object['jsonName'] = 'iast-data-request';
+    object['applicationUUID'] = Agent.getAgent().applicationInfo.applicationUUID;
+    object["batchSize"] = batchSize ? batchSize : 300;
+    object['completedRequestIds'] = getCompletedRequestIds();
+    return object;
+
+}
+
+
+module.exports = {
+    getCompletedRequestIds,
+    addRequestId,
+    removeRequestId,
+    generateIASTDataRequest,
+}
+
+

package/lib/nr-security-agent/lib/core/connections/websocket/response/collector-policy-handler.js

@@ -11,7 +11,10 @@ module.exports.handler = function handler(json) {
         const policyData = json.data;
         const PolicyManager = require('../../../Policy');
         PolicyManager.setPolicyData(policyData);
-        
+        if (policyData.vulnerabilityScan.enabled && policyData.vulnerabilityScan.iastScan.enabled) {
+            require('./fuzz-request-handler').startIASTSchedular();
+        }
+
     } catch (error) {
         logger.error('paring exception while parsing configuration', error);
     }