@newrelic/security-agent 0.1.2 → 0.2.0

package/lib/nr-security-agent/lib/core/logging.js

@@ -16,18 +16,24 @@ const LOG_PATTERN_OBJ = {
     type: 'pattern',
     pattern: '%[%d[%p][%c][%h][%z]%] %m'
 };
-const { LOG_DIR } = require('./sec-agent-constants');
+const { LOG_DIR, CSEC_HOME } = require('./sec-agent-constants');
 let logger;
 const API = require('../../../nr-security-api');
 const NRAgent = API.getNRAgent();
 
 const logFileName = `${LOG_DIR}node-security-collector.log`;
 const initLogFileName = `${LOG_DIR}node-security-collector-init.log`;
+let isLoggerOk = true;
 
-function createLogPathIfNotExist (dir) {
+
+function createLogPathIfNotExist(dir) {
     try {
         if (!fs.existsSync(dir)) {
-            fs.mkdirSync(dir, { recursive: true });
+            fs.mkdirSync(dir, 777, { recursive: true });
+            fs.chmodSync(dir, 0o777);
+        }
+        else {
+            fs.chmodSync(dir, 0o777);
         }
     } catch (error) {
     }
@@ -37,90 +43,103 @@ function createLogPathIfNotExist (dir) {
  * Initializes the logger appenders.
  * @param {v4uuid} applicationUUID
  */
-function initialize (applicationUUID) {
-    const appenders = {};
-    appenders.NR_CSEC = {
-        type: 'file',
-        compress: false,
-        layout: LOG_PATTERN_OBJ
-    };
-    appenders.NR_CSEC_INIT = {
-        type: 'file',
-        compress: false,
-        layout: LOG_PATTERN_OBJ
-    };
-
-    const logLevel = NRAgent && NRAgent.config && NRAgent.config.logging.enabled ? NRAgent.config.logging.level : 'info'; 
-
+function initialize(applicationUUID) {
     try {
-        if (!fs.existsSync(LOG_DIR)) {
-            createLogPathIfNotExist(LOG_DIR);
+        const logLevel = NRAgent && NRAgent.config && NRAgent.config.logging.enabled ? NRAgent.config.logging.level : 'info';
+        const apmLogFilePath = NRAgent && NRAgent.config && NRAgent.config.logging.enabled ? NRAgent.config.logging.filepath : '';
+        let appenderType = 'file';
+
+        if (apmLogFilePath === 'stdout') {
+            appenderType = 'stdout';
         }
-    } catch (error) {
-    }
 
-    Object.assign(appenders.NR_CSEC, {
-        filename: logFileName,
-        maxLogSize: LOG_FILE_SIZE,
-        backups: 0
-    });
-
-    Object.assign(appenders.NR_CSEC_INIT, {
-        filename: initLogFileName,
-        maxLogSize: LOG_FILE_SIZE,
-        backups: 0
-    });
-
-    const categories = {
-        default: {
-            appenders: [
-                'NR_CSEC'
-            ],
-            level: logLevel
-        },
-        NR_CSEC_INIT: {
-            appenders: [
-                'NR_CSEC_INIT',
-                'NR_CSEC'
-            ],
-            level: logLevel
-        },
-    };
-
-    if (env === 'dev' || env === 'trace') {
-        appenders.STDOUT = {
-            type: 'stdout',
+        const appenders = {};
+        appenders.NR_CSEC = {
+            type: appenderType,
+            compress: false,
             layout: LOG_PATTERN_OBJ
         };
-        categories.default.appenders.push('STDOUT');
-        categories.NR_CSEC_INIT.appenders.push('STDOUT');
-    }
+        appenders.NR_CSEC_INIT = {
+            type: appenderType,
+            compress: false,
+            layout: LOG_PATTERN_OBJ
+        };
+
+
+        createLogPathIfNotExist(CSEC_HOME);
+        createLogPathIfNotExist(LOG_DIR);
+
+
+        Object.assign(appenders.NR_CSEC, {
+            filename: logFileName,
+            maxLogSize: LOG_FILE_SIZE,
+            backups: 0
+        });
+
+        Object.assign(appenders.NR_CSEC_INIT, {
+            filename: initLogFileName,
+            maxLogSize: LOG_FILE_SIZE,
+            backups: 0
+        });
+
+        const categories = {
+            default: {
+                appenders: [
+                    'NR_CSEC'
+                ],
+                level: logLevel
+            },
+            NR_CSEC_INIT: {
+                appenders: [
+                    'NR_CSEC_INIT',
+                ],
+                level: logLevel
+            },
+        };
+
+        if (apmLogFilePath !== 'stdout') {
+            categories.NR_CSEC_INIT.appenders.push('NR_CSEC')
+        }
+
+
+        if (env === 'dev' || env === 'trace') {
+            appenders.STDOUT = {
+                type: 'stdout',
+                layout: LOG_PATTERN_OBJ
+            };
+            categories.default.appenders.push('STDOUT');
+            categories.NR_CSEC_INIT.appenders.push('STDOUT');
+        }
 
-    log4js.configure({
-        appenders: appenders,
-        categories: categories,
-        disableClustering: true
-    });
-    process.env.loglevel = logLevel;
+        log4js.configure({
+            appenders: appenders,
+            categories: categories,
+            disableClustering: true
+        });
+    } catch (error) {
+        console.error("Error while logging into file. Fallback to stdout.", error.message);
+        isLoggerOk = false;
+    }
 }
 
 /**
  * sets the logging level of current instance.
  * @param {String} level
  */
-function setLevel (level = INFO) {
+function setLevel(level = INFO) {
     level = level.trim();
     if (logger) {
         logger.level = level;
-    } else {
-        throw new Error('CSEC-Loggers Not yet Initialized!');
+    }
+    if (!isLoggerOk) {
+        logger.level = INFO;
     }
 }
 
 /**
  * get the logging level of current instance.
  */
-function getLevel () {
+function getLevel() {
     if (logger) {
         return logger.level;
     } else {
@@ -134,7 +153,7 @@ function getLevel () {
  * already made.
  * @param {v4uuid} applicationUUID
  */
-function getLogger (applicationUUID = process.env.applicationUUID) {
+function getLogger(applicationUUID = process.env.applicationUUID) {
     if (logger) {
         return logger;
     }
@@ -146,9 +165,8 @@ function getLogger (applicationUUID = process.env.applicationUUID) {
             fs.chmodSync(`${logFileName}`, 0o777);
             fs.chmodSync(`${initLogFileName}`, 0o777);
         } catch (error) {
-            logger.error("Error while setting up permissions on log files", error);
         }
-        initLogger.info("[STEP-2] => Generating unique identifier:",applicationUUID )
+        initLogger.info("[STEP-2] => Generating unique identifier:", applicationUUID)
         if (NRAgent) {
             setLevel(NRAgent.config.logging.level);
         }
@@ -159,14 +177,14 @@ function getLogger (applicationUUID = process.env.applicationUUID) {
     }
 }
 
-function reCreateLogger (applicationUUID) {
+function reCreateLogger(applicationUUID) {
     initialize(applicationUUID);
     logger = log4js.getLogger('NR_CSEC');
     setLevel(logger.level);
     updateModuleLoggers(logger);
 }
 
-function getInitLogger () {
+function getInitLogger() {
     const initLogger = log4js.getLogger('NR_CSEC_INIT');
     return initLogger;
 }

package/lib/nr-security-agent/lib/core/sec-agent-constants.js

@@ -49,7 +49,9 @@ module.exports = {
         COLLECTOR_CONFIG: 100,
         BLOCKING: 101,
         POLICY_ERROR: 102,
-        OBEY_WS_RECONNECT:12
+        OBEY_WS_RECONNECT:12,
+        ENTER_IAST_COOLDOWN:13,
+        IAST_RECORD_DELETE_CONFIRMATION:14
 
     },
     JSON_NAME: {
@@ -74,7 +76,6 @@ module.exports = {
         (process.env[AWS_EXECUTION_ENV_VAR] || '').match(AWS_LAMBDA_NODE_EXEC_ENV_IDENTIFIER)
     ),
     LAMBDA_RUNTIME_DIR_VAR: 'LAMBDA_RUNTIME_DIR',
-    CSEC_LAST_FUZZ_REQUEST_TIME: 'CSEC_LAST_FUZZ_REQUEST_TIME',
     NR_CSEC_FUZZ_REQUEST_ID: 'nr-csec-fuzz-request-id',
     EMPTY_APPLICATION_UUID: '--0--',
     QUESTIONMARK: '?',

package/lib/nr-security-agent/lib/core/statusUtils.js

@@ -95,7 +95,7 @@ function writeSnapshot() {
     commonUtils.removeOlderSnapshots();
     fs.writeFile(statusFile, snapshot, { mode: 0o777 }, function (err) {
         if (err) {
-            logger.error(err);
+            logger.debug(err.message);
         } else {
             logger.info('Snapshot updated to file: %s', statusFile);
             fs.chmod(statusFile, 0o777, (err) => {

package/lib/nr-security-agent/lib/core/websocket-client.js

@@ -4,8 +4,6 @@
  */
 
 'use strict';
-const path = require('path');
-const RingBuffer = require('ringbufferjs');
 const LOG_MESSAGES = require('./sec-agent-constants').LOG_MESSAGES;
 
 const { Agent } = require('./agent');
@@ -14,31 +12,21 @@ const hc = require('./health-check');
 const applicationInfo = require('./applicationinfo').getInstance();
 const logger = require('./logging').getLogger(applicationInfo.applicationUUID);
 const initLogger = require('./logging').getInitLogger();
-const { WorkerMessage, WORKER_STATUS } = require('./worker-entities');
 const commonUtils = require('./commonUtils');
 const API = require('../../../nr-security-api');
 const NRAgent = API.getNRAgent();
 const {
     SecWebSocket,
     setWebSocketConn,
-    aquireWebSocket,
     ResponseHandler: {
-        handle: handleServerResponse,
         setLogger: setResponseHandlerLogger
     }
 } = require('./connections/websocket');
 const { HC_INTERVAL_MS } = require('../../resources/config');
-const { IS_LAMBDA_ENV, LAMBDA_ENABLE_RESPONSE_BLOCKING, LOG_DIR } = require('./sec-agent-constants');
+const { LOG_DIR } = require('./sec-agent-constants');
 const statusUtils = require('./statusUtils');
 const njsAgentConstants = require('./sec-agent-constants');
 
-const MAX_BUSY_WAIT_TIME = 5000; // ms
-const workerSupported = commonUtils.hasWorker();;
-const filePath = path.join(__dirname, 'worker.js');
-const localQueue = new RingBuffer(1000);
-
-let busy = false;
-let wsWorker;
 let wsInstance;
 let dispatcher;
 
@@ -65,11 +53,8 @@ const initialize = function () {
 
     setResponseHandlerLogger(logger);
 
-    if (workerSupported) {
-        initiateInWorkerThread();
-    } else {
-        initializeInMainThread();
-    }
+    initializeInMainThread();
+
     // we'll dispatch the application info if it is updated
     Agent.eventEmitter.on(Agent.EVENTS.APPLICATION_INFO_UPDATE_EVENT, (applicationInfo) => {
         if (!NRAgent || (NRAgent && applicationInfo.entityGuid)) {
@@ -78,12 +63,7 @@ const initialize = function () {
     });
     Agent.eventEmitter.on(Agent.EVENTS.RECONNECT_WS_EVENT, () => {
         setWebSocketConn();
-        if (workerSupported) {
-            const reConnectMsg = new WorkerMessage(WorkerMessage.TYPE.RECONNECT, {});
-            wsWorker.postMessage(reConnectMsg);
-        } else {
-            wsInstance.reconnect();
-        }
+        wsInstance.reconnect();
     });
 
     setTimeout(() => {
@@ -106,102 +86,11 @@ function initializeInMainThread() {
         dispatcher = function dispatcher(message) {
             wsInstance.dispatch(message);
         };
-
-        // Setup the event listeners
-        wsInstance.event.on(SecWebSocket.Events.BUSY, function () {
-            busy = true;
-        });
-        wsInstance.event.on(SecWebSocket.Events.INACTIVE, function () {
-            busy = false;
-        });
     } else {
         return wsInstance;
     }
 }
 
-/**
- * This initiates the ws in worker thread
- */
-function initiateInWorkerThread() {
-    if (workerSupported) {
-        process.env.WS_WORKER_STATUS = WORKER_STATUS.INITIALIZING;
-        try {
-            setWebSocketConn();
-            const { Worker, SHARE_ENV } = require('worker_threads');
-            wsWorker = new Worker(filePath, {
-                workerData: {
-                    applicationInfo
-                },
-                env: SHARE_ENV
-            });
-            wsWorker.on('message', handleWorkerMessage);
-            wsWorker.on('error', (err) => {
-                logger.error('Exception in web socket worker:', err.message);
-                wsWorker = new Worker(filePath, {
-                    workerData: {
-                        applicationInfo
-                    }, env: SHARE_ENV
-                });
-            });
-            dispatcher = function dispatcher(message) {
-                if (process.env.WS_WORKER_STATUS !== WORKER_STATUS.RUNNING) {
-                    localQueue.enq(message);
-                    return;
-                }
-                // websocket is aquired here and then
-                // released in worker thread when the
-                // handoff to websocket is confirmed
-                aquireWebSocket();
-                const msg = new WorkerMessage(WorkerMessage.TYPE.MESSAGE, message);
-                wsWorker.postMessage(msg);
-            };
-            logger.info(LOG_MESSAGES.NODE_VERSION_MSG_WORKER, process.version);
-        } catch (error) {
-            logger.debug('error is:', error);
-        }
-    }
-}
-
-/**
- * This handles any messages received from worker
- * if websocket worker is initialized
- *
- * @param {JSON} json
- */
-function handleWorkerMessage(json) {
-    const msg = WorkerMessage.parseFromObject(json);
-    switch (msg.type) {
-        case WorkerMessage.TYPE.MESSAGE: {
-            logger.debug(LOG_MESSAGES.MSG_FROM_WORKKER, msg.getPayload());
-            handleServerResponse(msg.getPayload());
-            break;
-        }
-        case WorkerMessage.TYPE.FLUSH: {
-            const { status } = msg.getPayload();
-            if (status === 'flushed') {
-                logger.debug('Message from worker thread: Flush Completed');
-            }
-            break;
-        }
-        case WorkerMessage.TYPE.IC_READY_FOR_EVENTS: {
-            break;
-        }
-        case WorkerMessage.TYPE.BUSY: {
-            busy = true;
-            break;
-        }
-        case WorkerMessage.TYPE.INACTIVE: {
-            busy = false;
-            break;
-        }
-        case WorkerMessage.TYPE.ERROR: {
-            statusUtils.addErrortoBuffer(msg.getPayload());
-            break;
-        }
-        default:
-    }
-}
-
 /**
  * Sends Agent HelthCheck to Validator.
  */
@@ -267,66 +156,14 @@ function sendEvent(event, callback = DEFAULT_EVENT_SEND_CB) {
     callback();
 };
 
-/**
- * Flushes local queue to the worker
- */
-function flushLocalQueue() {
-    if (!workerSupported) return;
-
-    while (!localQueue.isEmpty()) {
-        dispatcher(localQueue.deq());
-    }
-}
-
-/**
- * Waits for websocket to get idel before
- * exiting the lambda function
- * @param {Number} startTime
- */
-function busyWaitOnWorkerThread(startTime = Date.now()) {
-    if (!workerSupported) return;
-
-    const workerInitiatedOnWait = process.env.WS_WORKER_STATUS === WORKER_STATUS.RUNNING;
-    const enableWait = !IS_LAMBDA_ENV || process.env[LAMBDA_ENABLE_RESPONSE_BLOCKING] === 'true';
-
-    let flushed = false;
-    let wait = (
-        process.env.CSEC_WS_STATE === SecWebSocket.States.CONNECTING ||
-        (
-            enableWait &&
-            process.env.CSEC_WS_STATE === SecWebSocket.States.BUSY
-        )
-    ) && (startTime + MAX_BUSY_WAIT_TIME > Date.now());
-    while (wait) {
-        wait = (
-            process.env.CSEC_WS_STATE === SecWebSocket.States.CONNECTING ||
-            (
-                enableWait &&
-                process.env.CSEC_WS_STATE === SecWebSocket.States.BUSY
-            )
-        ) && (startTime + MAX_BUSY_WAIT_TIME > Date.now());
-
-        if (!flushed && !workerInitiatedOnWait && process.env.WS_WORKER_STATUS === WORKER_STATUS.RUNNING) {
-            flushed = true;
-            flushLocalQueue();
-        }
-    }
-}
 
 function obeyReconnect() {
-    if (workerSupported) {
-        const reConnectMsg = new WorkerMessage(WorkerMessage.TYPE.OBEY_RECONNECT, {});
-        wsWorker.postMessage(reConnectMsg);
-    } else {
-        wsInstance.obeyReconnect();
-    }
+    wsInstance.obeyReconnect();
 }
 
 module.exports = {
     initialize,
     write: sendEvent,
     dispatcher: getDispatcherAndSendEvent,
-    flushLocalQueue,
-    busyWaitOnWorkerThread,
     obeyReconnect
 };

package/lib/nr-security-agent/lib/core/xss-utils.js

@@ -4,13 +4,12 @@
  */
 
 const _ = require('lodash');
-const { AllHtmlEntities } = require('html-entities');
 const decode = require('unescape');
 const querystring = require('querystring');
 
 const { Agent } = require('./agent');
 
-const entities = new AllHtmlEntities();
+const htmlEntities = require('html-entities');
 
 const tagNameRegex = /<([a-zA-Z_-]+[0-9]*|!--)/gmi;
 const attribRegex = /([^(/\s<'">)]+?)(?:\s*)=\s*(('|")([\s\S]*?)(?:(?=(\\?))\5.)*?\3|.+?(?=\/>|>|\?>|\s|<\/|$))/gmi;
@@ -222,7 +221,7 @@ function getXSSConstructs (data) {
                 if (!_.isEmpty(key) && (upperCaseAttribKey.startsWith('ON') || upperCaseAttribKey === 'SRC' || upperCaseAttribKey === 'HREF' ||
                     upperCaseAttribKey === 'ACTION' || upperCaseAttribKey === 'FORMACTION' || upperCaseAttribKey === 'SRCDOC' ||
                     upperCaseAttribKey === 'DATA' || decode(val).toUpperCase().replace(/\s/g, '').includes('JAVASCRIPT:') ||
-                    entities.decode(val).toUpperCase().replace(/\s/g, '').includes('JAVASCRIPT:'))) {
+                    htmlEntities.decode(val).toUpperCase().replace(/\s/g, '').includes('JAVASCRIPT:'))) {
                     isAttackConstruct = true;
                 }
             } else {

package/lib/nr-security-agent/resources/config.js

@@ -11,8 +11,8 @@ if(process.platform == 'win32'){
     AGENT_DIR = path.join(__dirname, "..\\..\\..\\");
 }
 
-const uuidv4 = require('uuid/v4');
-process.env.applicationUUID = process.env.applicationUUID || uuidv4();
+const uuid = require('uuid');
+process.env.applicationUUID = process.env.applicationUUID || uuid.v4();
 
 module.exports = {
     AGENT_DIR,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@newrelic/security-agent",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "description": "New Relic Security Agent for Node.js",
   "main": "index.js",
   "jsonVersion": "1.0.1",
@@ -37,25 +37,25 @@
   "dependencies": {
     "@aws-sdk/client-lambda": "^3.348.0",
     "axios": "0.21.4",
-    "check-disk-space": "^3.1.0",
-    "content-type": "^1.0.4",
-    "fast-safe-stringify": "^2.0.7",
+    "check-disk-space": "^3.4.0",
+    "content-type": "^1.0.5",
+    "fast-safe-stringify": "^2.1.1",
     "find-package-json": "^1.2.0",
     "hash.js": "^1.1.7",
-    "html-entities": "^1.2.1",
+    "html-entities": "^2.3.6",
     "is-invalid-path": "^1.0.2",
     "js-yaml": "^4.1.0",
-    "jsonschema": "^1.4.0",
+    "jsonschema": "^1.4.1",
     "lodash": "^4.17.21",
-    "log4js": "^6.0.0",
+    "log4js": "^6.9.1",
     "pretty-bytes": "^5.6.0",
-    "request-ip": "^2.1.3",
+    "request-ip": "^3.3.0",
     "ringbufferjs": "^2.0.0",
-    "semver": "^6.3.0",
+    "semver": "^7.5.3",
     "sync-request": "^6.1.0",
     "unescape": "^1.0.1",
     "unescape-js": "^1.1.4",
-    "uuid": "^3.4.0",
+    "uuid": "^9.0.0",
     "ws": "^7.5.9"
   },
   "devDependencies": {
@@ -81,7 +81,7 @@
     "mongodb-memory-server": "^8.11.2",
     "mongodb2": "npm:mongodb@^2.2.36",
     "mongodb3": "npm:mongodb@^3.7.3",
-    "newrelic": "^9.15.0",
+    "newrelic": "^10.3.1",
     "request": "^2.88.2",
     "restify": "^11.1.0",
     "sinon": "^15.0.0",

package/lib/nr-security-agent/lib/core/worker-entities.js

@@ -1,82 +0,0 @@
-/*
- * Copyright 2023 New Relic Corporation. All rights reserved.
- * SPDX-License-Identifier: New Relic Pre-Release
- */
-
-const MESSAGE = 'MESSAGE';
-const FLUSH = 'FLUSH';
-const BUSY = 'BUSY';
-const INACTIVE = 'INACTIVE';
-const RECONNECT = 'RECONNECT';
-const UPDATE_APPLICATION_INFO = 'UPDATE APPLICATION INFO';
-const IC_READY_FOR_EVENTS = 'IC READY FOR EVENTS';
-const INITIALIZING_STATUS = 'initializing';
-const NONE_STATUS = '';
-const RUNNING_STATUS = 'running';
-const ENDED_STATUS = 'ended';
-const ERROR = 'ERROR';
-const OBEY_RECONNECT = 'obey-reconnect';
-
-/**
- * This defines and constructs a worker message.
- * @param {String} type
- * @param {Object} payload
- */
-function WorkerMessage (type, payload) {
-    this.type = type;
-    this.payload = payload;
-}
-
-WorkerMessage.prototype = {};
-WorkerMessage.prototype.constructor = WorkerMessage;
-
-/**
- * Returns the type of worker message
- */
-WorkerMessage.prototype.getType = function getType () {
-    return this.type;
-};
-
-/**
- * returns the actual payload of message
- */
-WorkerMessage.prototype.getPayload = function getPayload () {
-    return this.payload;
-};
-
-WorkerMessage.TYPE = {
-    MESSAGE,
-    FLUSH,
-    BUSY,
-    INACTIVE,
-    RECONNECT,
-    UPDATE_APPLICATION_INFO,
-    IC_READY_FOR_EVENTS,
-    ERROR, 
-    OBEY_RECONNECT
-
-};
-
-/**
- * parses a Worker thread from simple object
- * @param {Object} obj
- */
-WorkerMessage.parseFromObject = function parseFromObject (obj) {
-    if (obj && obj.type && obj.payload) {
-        return new WorkerMessage(obj.type, obj.payload);
-    }
-
-    return false;
-};
-
-const WORKER_STATUS = {
-    NONE: NONE_STATUS,
-    INITIALIZING: INITIALIZING_STATUS,
-    RUNNING: RUNNING_STATUS,
-    ENDED: ENDED_STATUS
-};
-
-module.exports = {
-    WorkerMessage,
-    WORKER_STATUS
-};