@newrelic/security-agent 0.6.0 → 1.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +22 -0
- package/LICENSE +20 -25
- package/README.md +13 -1
- package/THIRD_PARTY_NOTICES.md +1 -211
- package/lib/instrumentation-security/core/constants.js +1 -1
- package/lib/instrumentation-security/core/event-constants.js +1 -1
- package/lib/instrumentation-security/core/request-manager.js +1 -1
- package/lib/instrumentation-security/core/route-manager.js +1 -1
- package/lib/instrumentation-security/core/sec-trace.js +1 -1
- package/lib/instrumentation-security/core/sec-utils.js +1 -1
- package/lib/instrumentation-security/core/security-metadata.js +1 -1
- package/lib/instrumentation-security/core/stack-trace.js +1 -1
- package/lib/instrumentation-security/hooks/@nestjs/nr-nestjs-core.js +1 -1
- package/lib/instrumentation-security/hooks/director/nr-director.js +1 -1
- package/lib/instrumentation-security/hooks/express/nr-express.js +1 -1
- package/lib/instrumentation-security/hooks/fastify/nr-fastify.js +1 -1
- package/lib/instrumentation-security/hooks/fs/nr-fs.js +40 -9
- package/lib/instrumentation-security/hooks/hapi/nr-hapi.js +1 -1
- package/lib/instrumentation-security/hooks/http/nr-http.js +68 -4
- package/lib/instrumentation-security/hooks/koa/@koa/nr-@koa-router.js +1 -1
- package/lib/instrumentation-security/hooks/ldap/nr-ldap.js +1 -1
- package/lib/instrumentation-security/hooks/mongodb/common.js +1 -1
- package/lib/instrumentation-security/hooks/mongodb/constants.js +1 -1
- package/lib/instrumentation-security/hooks/mongodb/nr-mongodb.js +1 -1
- package/lib/instrumentation-security/hooks/mongodb/v2-mongo.js +1 -1
- package/lib/instrumentation-security/hooks/mongodb/v3-mongo.js +1 -1
- package/lib/instrumentation-security/hooks/mongodb/v4-mongo.js +1 -1
- package/lib/instrumentation-security/hooks/mysql/nr-mysql.js +1 -1
- package/lib/instrumentation-security/hooks/native/nr-childProcess.js +1 -1
- package/lib/instrumentation-security/hooks/postgres/nr-postgres.js +1 -1
- package/lib/instrumentation-security/hooks/require/nr-require.js +4 -3
- package/lib/instrumentation-security/hooks/restify/nr-restify.js +1 -1
- package/lib/instrumentation-security/hooks/xpath/nr-xpath.js +1 -1
- package/lib/instrumentation-security/index.js +1 -1
- package/lib/nr-security-agent/index.js +1 -1
- package/lib/nr-security-agent/lib/core/Auth-headers.js +1 -1
- package/lib/nr-security-agent/lib/core/ContainerProperties.js +1 -1
- package/lib/nr-security-agent/lib/core/ECSProperties.js +1 -1
- package/lib/nr-security-agent/lib/core/FuzzFailEvent.js +1 -1
- package/lib/nr-security-agent/lib/core/LinkingMetadata.js +1 -1
- package/lib/nr-security-agent/lib/core/LogMessage.js +4 -3
- package/lib/nr-security-agent/lib/core/PodProperties.js +1 -1
- package/lib/nr-security-agent/lib/core/Policy.js +1 -1
- package/lib/nr-security-agent/lib/core/agent-status.js +1 -1
- package/lib/nr-security-agent/lib/core/agent.js +1 -1
- package/lib/nr-security-agent/lib/core/applicationinfo.js +1 -1
- package/lib/nr-security-agent/lib/core/commonUtils.js +8 -1
- package/lib/nr-security-agent/lib/core/connections/aws-lambda-client.js +7 -9
- package/lib/nr-security-agent/lib/core/connections/restclient.js +1 -1
- package/lib/nr-security-agent/lib/core/connections/websocket/index.js +1 -1
- package/lib/nr-security-agent/lib/core/connections/websocket/response/IASTUtils.js +1 -1
- package/lib/nr-security-agent/lib/core/connections/websocket/response/collecotor-policy-error-handler.js +1 -1
- package/lib/nr-security-agent/lib/core/connections/websocket/response/collector-policy-handler.js +1 -1
- package/lib/nr-security-agent/lib/core/connections/websocket/response/fuzz-request-handler.js +2 -2
- package/lib/nr-security-agent/lib/core/connections/websocket/response/iast-cool-down.js +1 -1
- package/lib/nr-security-agent/lib/core/connections/websocket/response/iast-record-deletion.js +1 -1
- package/lib/nr-security-agent/lib/core/connections/websocket/response/index.js +2 -2
- package/lib/nr-security-agent/lib/core/connections/websocket/response/no-op-handler.js +1 -1
- package/lib/nr-security-agent/lib/core/connections/websocket/response/startup-handshake-handler.js +4 -1
- package/lib/nr-security-agent/lib/core/connections/websocket/response/unsupported-agent-handler.js +1 -1
- package/lib/nr-security-agent/lib/core/connections/websocket/response/ws-reconnect.js +1 -1
- package/lib/nr-security-agent/lib/core/connections/websocket/websocket.js +1 -1
- package/lib/nr-security-agent/lib/core/event-stats.js +1 -1
- package/lib/nr-security-agent/lib/core/event.js +7 -2
- package/lib/nr-security-agent/lib/core/health-check.js +1 -1
- package/lib/nr-security-agent/lib/core/json-file-handler.js +1 -1
- package/lib/nr-security-agent/lib/core/jsonValidator.js +1 -1
- package/lib/nr-security-agent/lib/core/lambda-delegated-task-service.js +1 -1
- package/lib/nr-security-agent/lib/core/logging.js +1 -1
- package/lib/nr-security-agent/lib/core/sec-agent-constants.js +1 -1
- package/lib/nr-security-agent/lib/core/sec-util.js +1 -1
- package/lib/nr-security-agent/lib/core/sha-size-util.js +1 -1
- package/lib/nr-security-agent/lib/core/sha_worker.js +1 -1
- package/lib/nr-security-agent/lib/core/startup-config.js +1 -1
- package/lib/nr-security-agent/lib/core/statusUtils.js +5 -2
- package/lib/nr-security-agent/lib/core/timeunit.js +1 -1
- package/lib/nr-security-agent/lib/core/websocket-client.js +11 -1
- package/lib/nr-security-agent/lib/core/xss-utils.js +1 -1
- package/lib/nr-security-agent/lib/models/lambda-delegated-task/constants.js +1 -1
- package/lib/nr-security-agent/lib/models/lambda-delegated-task/index.js +1 -1
- package/lib/nr-security-agent/lib/models/lambda-delegated-task/lambda-delegated-sha-calculation.js +1 -1
- package/lib/nr-security-agent/lib/models/lambda-delegated-task/lambda-delegated-task-base.js +1 -1
- package/lib/nr-security-agent/lib/models/lambda-delegated-task/lambda-delegated-task-type.js +1 -1
- package/lib/nr-security-agent/resources/config.js +1 -1
- package/lib/nr-security-api/index.js +1 -1
- package/package.json +3 -4
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
/*
|
|
2
2
|
* Copyright 2023 New Relic Corporation. All rights reserved.
|
|
3
|
-
* SPDX-License-Identifier: New Relic
|
|
3
|
+
* SPDX-License-Identifier: New Relic Software License v1.0
|
|
4
4
|
*/
|
|
5
5
|
|
|
6
6
|
module.exports = initialize
|
|
@@ -272,7 +272,7 @@ function emitHook(shim, mod, moduleName) {
|
|
|
272
272
|
if (NRAgent && NRAgent.config.security.detection.rxss.enabled) {
|
|
273
273
|
responseHook(resp, req, shim);
|
|
274
274
|
}
|
|
275
|
-
|
|
275
|
+
|
|
276
276
|
shim.wrap(req, 'on', function makeOnWrapper(shim, fn) {
|
|
277
277
|
if (!shim.isFunction(fn)) {
|
|
278
278
|
return fn
|
|
@@ -390,30 +390,94 @@ function responseHook(resp, req, shim) {
|
|
|
390
390
|
const construct = API.checkForReflectedXSS(request, response.res.body, response.getHeaders());
|
|
391
391
|
const policy = API.getPolicy();
|
|
392
392
|
const dynamicScanningFlag = policy.data ? (policy.data.vulnerabilityScan?.enabled && policy.data.vulnerabilityScan.iastScan.enabled) : false;
|
|
393
|
-
|
|
393
|
+
const type = response.getHeader(CONTENT_TYPE);
|
|
394
|
+
let isUnsupportedType = isUnsupportedContentType(type);
|
|
395
|
+
|
|
396
|
+
if (request && (construct || dynamicScanningFlag) && !isUnsupportedType) {
|
|
394
397
|
const args = [];
|
|
395
398
|
args.push(construct);
|
|
396
399
|
args.push(response.res.body);
|
|
397
400
|
const traceObject = secUtils.getTraceObject(shim);
|
|
398
401
|
const secMetadata = securityMetaData.getSecurityMetaData(request, args, traceObject, secUtils.getExecutionId(), EVENT_TYPE.REFLECTED_XSS, EVENT_CATEGORY.REFLECTED_XSS)
|
|
399
402
|
const secEvent = API.generateSecEvent(secMetadata);
|
|
400
|
-
|
|
403
|
+
secEvent.httpResponse = {};
|
|
404
|
+
secEvent.httpResponse.contentType = response.getHeader(CONTENT_TYPE);
|
|
401
405
|
API.sendEvent(secEvent);
|
|
402
406
|
}
|
|
403
407
|
return fn.apply(this, arguments);
|
|
404
408
|
}
|
|
405
409
|
})
|
|
406
410
|
}
|
|
411
|
+
/**
|
|
412
|
+
* Utility to check unsupported content types
|
|
413
|
+
* @param {*} conType
|
|
414
|
+
* @returns
|
|
415
|
+
*/
|
|
416
|
+
function isUnsupportedContentType(conType) {
|
|
417
|
+
try {
|
|
418
|
+
if (!conType) {
|
|
419
|
+
return true;
|
|
420
|
+
}
|
|
421
|
+
const unsupportedTypes = ["video/",
|
|
422
|
+
"image/",
|
|
423
|
+
"font/",
|
|
424
|
+
"audio/",
|
|
425
|
+
"application/zip",
|
|
426
|
+
"application/epub+zip",
|
|
427
|
+
"application/gzip",
|
|
428
|
+
"application/java-archive",
|
|
429
|
+
"application/msword",
|
|
430
|
+
"application/octet-stream",
|
|
431
|
+
"application/ogg",
|
|
432
|
+
"application/pdf",
|
|
433
|
+
"application/rtf",
|
|
434
|
+
"application/vnd.amazon.ebook",
|
|
435
|
+
"application/vnd.apple.installer+xml",
|
|
436
|
+
"application/vnd.ms-excel",
|
|
437
|
+
"application/vnd.ms-fontobject",
|
|
438
|
+
"application/vnd.ms-powerpoint",
|
|
439
|
+
"application/vnd.oasis.opendocument.presentation",
|
|
440
|
+
"application/vnd.oasis.opendocument.spreadsheet",
|
|
441
|
+
"application/vnd.oasis.opendocument.text",
|
|
442
|
+
"application/vnd.openxmlformats-officedocument.presentationml.presentation",
|
|
443
|
+
"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
|
|
444
|
+
"application/vnd.openxmlformats-officedocument.wordprocessingml.document",
|
|
445
|
+
"application/vnd.rar",
|
|
446
|
+
"application/vnd.visio",
|
|
447
|
+
"application/x-7z-compressed",
|
|
448
|
+
"application/x-abiword",
|
|
449
|
+
"application/x-bzip",
|
|
450
|
+
"application/x-bzip2",
|
|
451
|
+
"application/x-cdf",
|
|
452
|
+
"application/x-freearc",
|
|
453
|
+
"application/x-tar",
|
|
454
|
+
"application/zip",
|
|
455
|
+
"text/calendar"
|
|
456
|
+
];
|
|
457
|
+
|
|
458
|
+
const startsWithAny = unsupportedTypes.some(prefix => conType.startsWith(prefix));
|
|
459
|
+
return startsWithAny;
|
|
460
|
+
} catch (error) {
|
|
461
|
+
logger.debug("Error while checking unsupported content type");
|
|
462
|
+
}
|
|
463
|
+
|
|
464
|
+
}
|
|
407
465
|
|
|
408
466
|
function responseBodyCompute(response, args) {
|
|
409
467
|
let encoding = UTF8;
|
|
410
468
|
const type = response.getHeader(CONTENT_TYPE);
|
|
469
|
+
let isUnsupportedType = isUnsupportedContentType(type);
|
|
470
|
+
if (isUnsupportedType) {
|
|
471
|
+
return;
|
|
472
|
+
}
|
|
473
|
+
|
|
411
474
|
let contentType = TEXT_HTML;
|
|
412
475
|
if (type) {
|
|
413
476
|
const obj = ConType.parse(type);
|
|
414
477
|
contentType = obj.type;
|
|
415
478
|
encoding = obj.parameters.charset;
|
|
416
479
|
}
|
|
480
|
+
|
|
417
481
|
if (args[0]) {
|
|
418
482
|
switch (contentType) {
|
|
419
483
|
case APPLICATION_JSON:
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
/*
|
|
2
2
|
* Copyright 2023 New Relic Corporation. All rights reserved.
|
|
3
|
-
* SPDX-License-Identifier: New Relic
|
|
3
|
+
* SPDX-License-Identifier: New Relic Software License v1.0
|
|
4
4
|
*/
|
|
5
5
|
|
|
6
6
|
const requestManager = require('../../core/request-manager');
|
|
@@ -73,7 +73,8 @@ function requireHook(shim, moduleName, parent) {
|
|
|
73
73
|
}
|
|
74
74
|
}
|
|
75
75
|
if (request) {
|
|
76
|
-
|
|
76
|
+
let resolvedModulePath = require.resolve(moduleName)
|
|
77
|
+
const interceptedArgs = [resolvedModulePath];
|
|
77
78
|
let traceObject;
|
|
78
79
|
if (!fallback) {
|
|
79
80
|
traceObject = secUtils.getTraceObject(shim);
|
|
@@ -86,7 +87,7 @@ function requireHook(shim, moduleName, parent) {
|
|
|
86
87
|
API.sendEvent(secEvent);
|
|
87
88
|
}
|
|
88
89
|
} catch (error) {
|
|
89
|
-
|
|
90
|
+
|
|
90
91
|
}
|
|
91
92
|
|
|
92
93
|
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
/*
|
|
2
2
|
* Copyright 2023 New Relic Corporation. All rights reserved.
|
|
3
|
-
* SPDX-License-Identifier: New Relic
|
|
3
|
+
* SPDX-License-Identifier: New Relic Software License v1.0
|
|
4
4
|
*/
|
|
5
5
|
|
|
6
6
|
const LinkingMetaData = require('./LinkingMetadata');
|
|
@@ -19,7 +19,7 @@ function logMessageException(exception) {
|
|
|
19
19
|
let exceptionObject = {};
|
|
20
20
|
try {
|
|
21
21
|
exceptionObject.message = exception.message ? exception.message : '';
|
|
22
|
-
exceptionObject.cause =
|
|
22
|
+
exceptionObject.cause = null;
|
|
23
23
|
if (exception.stack) {
|
|
24
24
|
let stacktraceInList = exception.stack.split('\n');
|
|
25
25
|
stacktraceInList = stacktraceInList.slice(1);
|
|
@@ -46,7 +46,8 @@ function logMessage(level, message, caller, exception) {
|
|
|
46
46
|
try {
|
|
47
47
|
BasicInfo.call(this);
|
|
48
48
|
this.jsonVersion = applicationInfo.jsonVersion;
|
|
49
|
-
this.
|
|
49
|
+
this.pid = applicationInfo.pid ? applicationInfo.pid : null;
|
|
50
|
+
this.jsonName = 'critical-messages';
|
|
50
51
|
this.applicationUUID = applicationInfo.applicationUUID;
|
|
51
52
|
this.groupName = applicationInfo.groupName;
|
|
52
53
|
this.policyVersion = applicationInfo.policyVersion;
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
/*
|
|
2
2
|
* Copyright 2023 New Relic Corporation. All rights reserved.
|
|
3
|
-
* SPDX-License-Identifier: New Relic
|
|
3
|
+
* SPDX-License-Identifier: New Relic Software License v1.0
|
|
4
4
|
*/
|
|
5
5
|
const SecAgentStatus = function () {
|
|
6
6
|
if (Object.getPrototypeOf(this).constructor !== SecAgentStatus) {
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
/*
|
|
2
2
|
* Copyright 2023 New Relic Corporation. All rights reserved.
|
|
3
|
-
* SPDX-License-Identifier: New Relic
|
|
3
|
+
* SPDX-License-Identifier: New Relic Software License v1.0
|
|
4
4
|
*/
|
|
5
5
|
|
|
6
6
|
/* eslint-disable prefer-promise-reject-errors */
|
|
@@ -24,6 +24,7 @@ let websocketHealth;
|
|
|
24
24
|
const ringBuffer = require('ringbufferjs');
|
|
25
25
|
const bufferedLogEvents = new ringBuffer(10);
|
|
26
26
|
|
|
27
|
+
|
|
27
28
|
/**
|
|
28
29
|
* Utility to generate UUID
|
|
29
30
|
* @returns UUID
|
|
@@ -105,6 +106,9 @@ function createPathIfNotExist(dir) {
|
|
|
105
106
|
}
|
|
106
107
|
} catch (error) {
|
|
107
108
|
logger.debug(dir + ' Not Created', error);
|
|
109
|
+
const LogMessage = require('./LogMessage');
|
|
110
|
+
const logMessage = new LogMessage.logMessage("SEVERE", 'Error in creating directory', __filename, error);
|
|
111
|
+
addLogEventtoBuffer(logMessage);
|
|
108
112
|
}
|
|
109
113
|
}
|
|
110
114
|
|
|
@@ -283,6 +287,9 @@ function removeOlderSnapshots() {
|
|
|
283
287
|
}
|
|
284
288
|
} catch (error) {
|
|
285
289
|
logger.debug(error);
|
|
290
|
+
const LogMessage = require('./LogMessage');
|
|
291
|
+
const logMessage = new LogMessage.logMessage("SEVERE", 'Error in processing snapshot files', __filename, error);
|
|
292
|
+
addLogEventtoBuffer(logMessage);
|
|
286
293
|
}
|
|
287
294
|
}
|
|
288
295
|
/**
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
/*
|
|
2
2
|
* Copyright 2023 New Relic Corporation. All rights reserved.
|
|
3
|
-
* SPDX-License-Identifier: New Relic
|
|
3
|
+
* SPDX-License-Identifier: New Relic Software License v1.0
|
|
4
4
|
*/
|
|
5
5
|
|
|
6
6
|
const _ = require('lodash');
|
|
@@ -38,16 +38,14 @@ function invokeLambda (arn, version, data) {
|
|
|
38
38
|
}
|
|
39
39
|
|
|
40
40
|
function init () {
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
) {
|
|
45
|
-
|
|
41
|
+
try {
|
|
42
|
+
const { Lambda } = require('@aws-sdk/client-lambda');
|
|
43
|
+
lambdaClient = new Lambda();
|
|
44
|
+
} catch (error) {
|
|
45
|
+
logger.error("Unable to initialize lambda client", error);
|
|
46
46
|
}
|
|
47
|
-
|
|
48
|
-
const { Lambda } = require('@aws-sdk/client-lambda');
|
|
49
|
-
lambdaClient = new Lambda();
|
|
50
47
|
}
|
|
48
|
+
|
|
51
49
|
init();
|
|
52
50
|
|
|
53
51
|
module.exports = {
|
package/lib/nr-security-agent/lib/core/connections/websocket/response/fuzz-request-handler.js
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
/*
|
|
2
2
|
* Copyright 2023 New Relic Corporation. All rights reserved.
|
|
3
|
-
* SPDX-License-Identifier: New Relic
|
|
3
|
+
* SPDX-License-Identifier: New Relic Software License v1.0
|
|
4
4
|
*/
|
|
5
5
|
|
|
6
6
|
/* eslint-disable no-unused-vars */
|
|
@@ -101,7 +101,7 @@ function handler(json) {
|
|
|
101
101
|
logger.error('Parsing exeception in fuzz request: ', error);
|
|
102
102
|
|
|
103
103
|
const logMessage = new LogMessage.logMessage(SEVERE, 'Parsing exeception in fuzz request', __filename, error);
|
|
104
|
-
commonUtils.addLogEventtoBuffer(logMessage);
|
|
104
|
+
require('../../../commonUtils').addLogEventtoBuffer(logMessage);
|
|
105
105
|
}
|
|
106
106
|
if (!fuzzRequest) {
|
|
107
107
|
return;
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
/*
|
|
2
2
|
* Copyright 2023 New Relic Corporation. All rights reserved.
|
|
3
|
-
* SPDX-License-Identifier: New Relic
|
|
3
|
+
* SPDX-License-Identifier: New Relic Software License v1.0
|
|
4
4
|
*/
|
|
5
5
|
|
|
6
6
|
const _ = require('lodash');
|
|
@@ -41,7 +41,7 @@ const handle = function handle (json) {
|
|
|
41
41
|
} catch (error) {
|
|
42
42
|
logger.error("Error in handling Control Command",error);
|
|
43
43
|
const logMessage = new LogMessage.logMessage(SEVERE, 'Error in handling Control Command', __filename, error);
|
|
44
|
-
commonUtils.addLogEventtoBuffer(logMessage);
|
|
44
|
+
require('../../../commonUtils').addLogEventtoBuffer(logMessage);
|
|
45
45
|
}
|
|
46
46
|
|
|
47
47
|
};
|
package/lib/nr-security-agent/lib/core/connections/websocket/response/startup-handshake-handler.js
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
/*
|
|
2
2
|
* Copyright 2023 New Relic Corporation. All rights reserved.
|
|
3
|
-
* SPDX-License-Identifier: New Relic
|
|
3
|
+
* SPDX-License-Identifier: New Relic Software License v1.0
|
|
4
4
|
*/
|
|
5
5
|
|
|
6
6
|
const StartupConfig = require('../../../startup-config');
|
|
@@ -9,6 +9,7 @@ let logger = logs.getLogger();
|
|
|
9
9
|
const initLogger = logs.getInitLogger();
|
|
10
10
|
const LOG_MESSAGES = require('../../../sec-agent-constants').LOG_MESSAGES;
|
|
11
11
|
const applicationInfoModule = require('../../../applicationinfo');
|
|
12
|
+
const LogMessage = require('../../../LogMessage');
|
|
12
13
|
|
|
13
14
|
module.exports.handler = function handler(json) {
|
|
14
15
|
try {
|
|
@@ -17,6 +18,8 @@ module.exports.handler = function handler(json) {
|
|
|
17
18
|
|
|
18
19
|
initLogger.info(LOG_MESSAGES.AGENT_INIT_WITH_PROP, JSON.stringify(startupConfig.config));
|
|
19
20
|
initLogger.info('Security Agent is now ACTIVE for', applicationInfoModule.getInstance().applicationUUID);
|
|
21
|
+
const logMessage = new LogMessage.logMessage("SEVERE", `Security Agent is ACTIVE for ${ applicationInfoModule.getInstance().applicationUUID}`, __filename, null);
|
|
22
|
+
require('../../../commonUtils').addLogEventtoBuffer(logMessage);
|
|
20
23
|
|
|
21
24
|
} catch (error) {
|
|
22
25
|
logger.error(LOG_MESSAGES.PARSING_EXP_WELCOME_MSG, error);
|