@newrelic/security-agent 1.0.1 → 1.1.0

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+### v1.1.0 (2024-03-19)
+#### Features
+* IAST support for grpc 
+* Functionality to report API endpoints of the application
+* IAST support for undici
+#### Bug fixes
+* Updated permissions for file/directory created by security agent
+#### Miscellaneous chores
+* Bumped follow-redirects from v1.15.2 to v1.15.4  
+* Updated axios to v1.6.8
+* Bumped ip from v2.0.0 to v2.0.1
+* Bumped undici from 5.28.2 to v5.28.3
+* Readme update
+
 ### v1.0.1 (2024-02-07)
 #### Bug fixes
 * Reporting of framework in security event json 

package/README.md

@@ -3,7 +3,7 @@
 
 **Note**: The IAST capability should only be used in pre-production environments as the application is tested for real exploitable vulnerabilities.
 
-The New Relic security agent is in preview and is not generally available. This module enables instrumentation of a Node.js application for interactive application security testing(IAST) and exposes exploitable vulnerabilities. 
+The New Relic security agent enables instrumentation of a Node.js application for Interactive Application Security Testing(IAST) and exposes exploitable vulnerabilities. 
 
 ## Installation
 
@@ -67,6 +67,8 @@ The [Developer docs](http://newrelic.github.io/node-newrelic/) for writing instr
 - [ldapts](https://www.npmjs.com/package/ldapts)(2.x and above)
 - [xpath](https://www.npmjs.com/package/xpath)(0.0.20 and above)
 - [xpath.js](https://www.npmjs.com/package/xpath.js)(0.0.1 and above) 
+- [undici](https://www.npmjs.com/package/undici)(4.7.0 and above) 
+- [@grpc/grpc-js](https://www.npmjs.com/package/@grpc/grpc-js)(1.4.x and above)
 
 For more information, please see New Relic Node.js agent [compatibility and requirements](https://docs.newrelic.com/docs/apm/agents/nodejs-agent/getting-started/compatibility-requirements-nodejs-agent/).
 

package/lib/instrumentation-security/core/grpc-utils.js

@@ -0,0 +1,53 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: New Relic Pre-Release
+ */
+
+
+const grpcServiceMap = new Map();
+const grpcMethodMap = new Map();
+/**
+ * Utility to set service based on key value pair
+ * @param {*} key 
+ * @param {*} value 
+ */
+function setService(key, value){
+    grpcServiceMap.set(key,value);
+}
+
+/**
+ * Utility to get service corresponding to key
+ * @param {*} key 
+ * @returns 
+ */
+function getService(key){
+    return grpcServiceMap.get(key);
+}
+
+/**
+ * Utility to set method object
+ * @param {*} key 
+ * @param {*} value 
+ */
+function setMethod(key, value){
+    grpcMethodMap.set(key,value);
+}
+
+/**
+ * Utility to get method object
+ * @param {*} key 
+ * @returns 
+ */
+function getMethod(key){
+    return grpcMethodMap.get(key);
+}
+
+module.exports={
+    setService,
+    getService,
+    grpcServiceMap,
+    setMethod,
+    getMethod,
+    grpcMethodMap
+
+}

package/lib/instrumentation-security/core/route-manager.js

@@ -10,8 +10,8 @@ const routeMap = new Map();
  * @param {*} key 
  * @param {*} value 
  */
-function setRoute(key, value){
-    routeMap.set(key,value);
+function setRoute(key, value) {
+    routeMap.set(key, value);
 }
 
 /**
@@ -19,12 +19,35 @@ function setRoute(key, value){
  * @param {*} key 
  * @returns 
  */
-function getRoute(key){
+function getRoute(key) {
     return routeMap.get(key);
 }
 
-module.exports={
+/**
+ * Utility to get all api end points
+ * @returns all keys from routeMap
+ */
+function getAllAPIEndPoints() {
+    let apiEndpoints = [];
+    try {
+        routeMap.forEach((value, key) => {
+            let obj = {};
+            let splitted = key.split('@');
+            obj.method = splitted[0];
+            obj.path = splitted[1];
+            obj.handler = routeMap.get(key);
+            apiEndpoints.push(obj);
+        })
+    } catch (error) {
+
+    }
+
+    return apiEndpoints;
+}
+
+module.exports = {
     getRoute,
     setRoute,
-    routeMap
+    routeMap,
+    getAllAPIEndPoints
 }

package/lib/instrumentation-security/core/sec-utils.js

@@ -150,11 +150,11 @@ function getExecutionId(){
 function createPathIfNotExist (dir) {
     try {
         if (!fs.existsSync(dir)) {
-            fs.mkdirSync(dir, 777, { recursive: true });
+            fs.mkdirSync(dir, 770, { recursive: true });
             logger.info(dir + ' Created');
-            fs.chmodSync(dir, 0o777);
+            fs.chmodSync(dir, 0o770);
         } else {
-            fs.chmodSync(dir, 0o777);
+            fs.chmodSync(dir, 0o770);
             logger.debug(dir + ' Already Exists');
         }
     } catch (error) {

package/lib/instrumentation-security/hooks/express/nr-express.js

@@ -27,9 +27,8 @@ module.exports = function initialize(shim, express, moduleName) {
 
   if (express.Router.use) {
     wrapExpress4(shim, express)
-  } else {
-    // wrapExpress3(shim, express)
-  }
+  } 
+ 
 }
 
 /**
@@ -57,7 +56,6 @@ function wrapExpress4(shim, express) {
     }
   })
 
-
   //Wrapper to hook process_params method to extract out path param and query params.
   shim.wrap(express.Router, 'process_params', function wrapParam(shim, fn) {
     if (!shim.isFunction(fn)) {

package/lib/instrumentation-security/hooks/grpc-js/nr-grpc.js

@@ -0,0 +1,284 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: New Relic Pre-Release
+ */
+
+
+const requestManager = require("../../core/request-manager");
+const secUtils = require("../../core/sec-utils");
+const API = require("../../../nr-security-api");
+const securityMetaData = require('../../core/security-metadata');
+const { EVENT_TYPE, EVENT_CATEGORY } = require('../../core/event-constants');
+const { NR_CSEC_FUZZ_REQUEST_ID } = require('../../core/constants');
+const logger = API.getLogger();
+const semver = require('semver');
+const grpcutils = require('../../core/grpc-utils');
+let serverAddress;
+
+
+module.exports.initialize = function initialize(shim, grpc, moduleName) {
+  logger.info('Instrumenting grpc', moduleName);
+  const grpcVersion = shim.require('./package.json').version;
+  logger.debug("grpc version:", grpcVersion);
+
+  if (semver.lt(grpcVersion, '1.4.0')) {
+    logger.warn('gRPC server-side instrumentation only supported on grpc-js >=1.4.0')
+    return
+  }
+
+  if (semver.gte(grpcVersion, '1.8.0')) {
+    const resolvingCall = shim.require('./build/src/resolving-call')
+    shim.wrap(resolvingCall.ResolvingCall.prototype, 'start', wrapStart)
+  } else {
+    const callStream = shim.require('./build/src/call-stream')
+    shim.wrap(callStream.Http2CallStream.prototype, 'start', wrapStart)
+  }
+
+
+  const server = shim.require('./build/src/server')
+  shim.wrap(server.Server.prototype, 'bindAsync', bindAsyncWrapper)
+  shim.wrap(server.Server.prototype, 'register', wrapRegister)
+
+  //get all service
+  shim.wrap(server.Server.prototype, 'addService', wrapAddService);
+
+  //laod package def
+  const makeClient = shim.require('./build/src/make-client');
+  shim.wrap(makeClient, 'loadPackageDefinition', wrapLoadPackageDefinition);
+
+}
+
+
+module.exports.wrapStartResolve = function wrappedStartResolve(shim, resolvingCall) {
+  shim.wrap(resolvingCall.ResolvingCall.prototype, 'start', wrapStart)
+}
+
+module.exports.wrapStartCall = function wrappedClient(shim, callStream) {
+  shim.wrap(callStream.Http2CallStream.prototype, 'start', wrapStart)
+}
+
+module.exports.wrapServer = function wrappedServer(shim, server) {
+  const grpcVersion = shim.require('./package.json').version
+  logger.info("Instrumenting @grpc/grpc-js", grpcVersion)
+  if (semver.lt(grpcVersion, '1.4.0')) {
+    logger.warn('gRPC server-side instrumentation only supported on grpc-js >=1.4.0')
+    return
+  }
+
+  shim.wrap(server.Server.prototype, 'register', wrapRegister)
+  shim.wrap(server.Server.prototype, 'bindAsync', bindAsyncWrapper)
+  //get all service
+  shim.wrap(server.Server.prototype, 'addService', wrapAddService);
+}
+
+module.exports.wrapMakeClient = function wrapMakeClient(shim, makeClient) {
+  shim.wrap(makeClient, 'loadPackageDefinition', wrapLoadPackageDefinition);
+}
+
+
+/**
+ * Instruments grpc-js client by intercepting the function that
+ * initiates client requests. This handles all four types of client
+ * invocations: unary, client-streaming, server-streaming, and
+ * bidirectional streaming.
+ *
+ * @param {object} shim the generic shim to instrument with
+ * @param {Function} original the original function
+ * @returns {Function} the instrumented function
+ */
+function wrapStart(shim, original) {
+  return function wrappedStart() {
+    const channel = this.channel;
+    const authorityName = (channel.target && channel.target.path) || channel.getDefaultAuthority;
+    // in 1.8.0 this changed from methodName to method
+    const method = this.methodName || this.method;
+    const protocol = 'grpc:';
+    const url = `${protocol}//${authorityName}${method}`;
+    logger.debug("grpc url is:", url)
+    const request = requestManager.getRequest(shim);
+    let urlObj = {
+      "headers":
+      {
+        "host": authorityName
+      },
+      "method": method,
+      "path": method,
+      "protocol": protocol,
+    }
+    if (request) {
+      const traceObject = secUtils.getTraceObject(shim);
+      const secMetadata = securityMetaData.getSecurityMetaData(request, urlObj, traceObject, secUtils.getExecutionId(), EVENT_TYPE.HTTP_REQUEST, EVENT_CATEGORY.HTTP)
+      const secEvent = API.generateSecEvent(secMetadata);
+      API.sendEvent(secEvent);
+    }
+
+    const res = original.apply(this, arguments);
+    return res;
+  }
+}
+
+
+
+function wrapAddService(shim, original) {
+  return function wrappedbindAsync() {
+    const result = original.apply(this, arguments);
+    return result;
+  }
+}
+
+function wrapLoadPackageDefinition(shim, original) {
+  return function wrappedbindAsync() {
+    let serviceObject = arguments[0];
+    const result = original.apply(this, arguments);
+    iterateNestedObjectForServiceLookup(result, serviceObject);
+    return result;
+  }
+}
+
+
+
+
+function bindAsyncWrapper(shim, original) {
+  return function wrappedbindAsync() {
+    serverAddress = arguments[0];
+    shim.grpcServerAddress = serverAddress;
+    try {
+      const splittedData = serverAddress.split(":");
+      serverPort = splittedData[1];
+      shim.serverPort = parseInt(serverPort);
+    } catch (error) {
+
+    }
+    const result = original.apply(this, arguments);
+    return result;
+  }
+}
+
+
+
+/**
+ * Instruments the grpc-js server by intercepting the moment when
+ * server methods are registered from the method implementations
+ * provided to grpc-js. This handles all four types of server
+ * invocations: unary, client-streaming, server-streaming, and
+ * bidirectional streaming.
+ *
+ * @param {object} shim the web shim to instrument with
+ * @param {Function} original the original function
+ * @returns {Function} the instrumented function
+ */
+function wrapRegister(shim, original) {
+  return function wrappedRegister() {
+    wrapHandler(shim, arguments, '1');
+    const result = original.apply(this, arguments);
+    return result;
+  }
+}
+
+
+/**
+ * Wrapper to hook handler function
+ * @param {*} shim 
+ * @param {*} mod 
+ * @param {*} method 
+ */
+function wrapHandler(shim, mod, method) {
+  shim.wrap(mod, method, function wrapHandler(shim, fn) {
+    return function wrappedHandler() {
+      const type = this.type;
+      const path = this.path;
+      wrapCallback(shim, arguments, '1');
+      addRequestData(shim, type, path, arguments[0]);
+      const result = fn.apply(this, arguments);
+      return result;
+
+    }
+  })
+}
+
+/**
+ * Wrapper to hook callback response
+ * @param {*} shim 
+ * @param {*} mod 
+ * @param {*} method 
+ */
+function wrapCallback(shim, mod, method) {
+  shim.wrap(mod, method, function wrapCallback(shim, fn) {
+    return function wrappedCallback() {
+      const response = arguments[1];
+      const result = fn.apply(this, arguments);
+      return result;
+
+    }
+  })
+}
+
+/**
+ * Utility function to add grpc request data in request map
+ * @param {*} shim 
+ * @param {*} type 
+ * @param {*} path 
+ * @param {*} args 
+ */
+function addRequestData(shim, type, path, args) {
+  const data = Object.assign({});
+  try {
+    const segment = shim.getActiveSegment();
+    if (segment && segment.transaction) {
+      data.method = path;
+      data.url = path;
+      data.uri = path;
+      data.headers = args.metadata.getMap();
+      if (data.headers && data.headers[NR_CSEC_FUZZ_REQUEST_ID]) {
+        let bufferObj = Buffer.from(data.headers[NR_CSEC_FUZZ_REQUEST_ID], "base64");
+        let decodedString = bufferObj.toString("utf8");
+        data.headers[NR_CSEC_FUZZ_REQUEST_ID] = decodedString;
+      }
+      data.type = type;
+      data.protocol = 'grpc';
+      data.isGRPC = true;
+      data.body = JSON.stringify(args.request);
+      data.serverPort = shim.serverPort;
+      const transactionId = segment.transaction.id;
+      requestManager.setRequest(transactionId, data);
+    }
+  } catch (error) {
+    logger.error("Error occured while extracting grpc request", error);
+  }
+}
+
+/**
+ * Utilty to set grpc util Maps
+ * @param {*} serviceObject 
+ */
+function serviceUtil(serviceObject) {
+  let serviceValues = Object.values(serviceObject)[0];
+  for (const [key, value] of Object.entries(serviceValues)) {
+    let servObj = {
+      'serviceName': serviceObject.serviceName,
+      'originalName': value.originalName,
+    }
+    grpcutils.setMethod(value.path, servObj);
+  }
+}
+
+function iterateNestedObjectForServiceLookup(result, serviceObject) {
+  try {
+    for (const key in result) {
+      if (typeof result[key] === 'object' && result[key] !== 'null') {
+        iterateNestedObjectForServiceLookup(result[key], serviceObject); // Recurse into nested object
+      } else {
+        let value = result[key];
+        if (value && value.serviceName) {
+          if (!value.type && value.serviceName) {
+            grpcutils.setService(value.serviceName, serviceObject);
+            serviceUtil(value);
+          }
+        }
+      }
+    }
+  } catch (error) {
+    logger.error("Error while getting service definition", error);
+  }
+  
+}

package/lib/instrumentation-security/hooks/undici/nr-undici.js

@@ -0,0 +1,139 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: New Relic Pre-Release
+ */
+
+module.exports = initialize
+const requestManager = require('../../core/request-manager');
+const secUtils = require("../../core/sec-utils");
+const API = require("../../../nr-security-api");
+const lodash = require('lodash');
+const securityMetaData = require('../../core/security-metadata');
+const { EVENT_TYPE, EVENT_CATEGORY } = require('../../core/event-constants');
+const { NR_CSEC_FUZZ_REQUEST_ID, QUESTION_MARK, EMPTY_STRING, COLON, SLASH } = require('../../core/constants');
+const NRCSECTRACINGDATA = 'NR-CSEC-TRACING-DATA';
+const DOUBLE_SLASH = '//';
+const logger = API.getLogger();
+const url = require('url');
+
+
+/**
+ * Entry point undici module instrumentation.
+ * @param {*} shim 
+ * @param {*} mod 
+ * @param {*} moduleName 
+ */
+function initialize(shim, mod, moduleName) {
+  logger.info('Instrumenting ' + moduleName);
+  fetchHook(shim, mod, "fetch");
+  let util = shim.require('./lib/core/util');
+  parseOriginHook(shim, util, "parseOrigin")
+
+}
+/**
+ * Wrapper for util.parseOrigin
+ * @param {*} shim 
+ * @param {*} mod 
+ * @param {*} methodName 
+ */
+function parseOriginHook(shim, mod, methodName) {
+  shim.wrap(mod, methodName, function ClientWrapper(shim, fn) {
+    logger.debug(`Instrumenting ${methodName}`);
+    if (!shim.isFunction(fn)) {
+      return fn
+    }
+    return function wrapper() {
+      const request = requestManager.getRequest(shim);
+      try {
+        if (typeof arguments[0] === 'string') {
+          let URLObject = new URL(arguments[0]);
+          const data = {};
+          data.headers = {};
+          data.path = URLObject.pathname ? URLObject.pathname : EMPTY_STRING;
+          data.protocol = URLObject.protocol ? URLObject.protocol : 'http:';
+          data.headers.host = URLObject.host ? URLObject.host : URLObject.hostname;
+          shim.interceptedArgs = data;
+          if (request) {
+            const traceObject = secUtils.getTraceObject(shim);
+            const secMetadata = securityMetaData.getSecurityMetaData(request, data, traceObject, secUtils.getExecutionId(), EVENT_TYPE.HTTP_REQUEST, EVENT_CATEGORY.HTTP)
+            this.secEvent = API.generateSecEvent(secMetadata);
+            API.sendEvent(this.secEvent);
+          }
+        }
+      } catch (error) {
+
+      }
+      const result = fn.apply(this, arguments);
+      if (result && request && request.headers[NR_CSEC_FUZZ_REQUEST_ID]) {
+        API.generateExitEvent(this.secEvent);
+        delete this.secEvent
+      }
+      return result;
+    }
+  })
+}
+
+/**
+ * Wrapper to hook undici.fetch()
+ * @param {*} shim 
+ * @param {*} mod 
+ * @param {*} methodName 
+ */
+function fetchHook(shim, mod, methodName) {
+  shim.wrap(mod, methodName, function makeWrapper(shim, fn) {
+    logger.debug(`Instrumenting ${methodName}`);
+    if (!shim.isFunction(fn)) {
+      return fn
+    }
+    return function wrapper() {
+      const request = requestManager.getRequest(shim);
+      try {
+        const completeURL = arguments[0];
+        const parsedUrl = url.parse(completeURL);
+        const data = {};
+        data.headers = {};
+        data.method = arguments[0].method ? arguments[0].method : EMPTY_STRING;
+        data.path = parsedUrl.pathname ? parsedUrl.pathname : parsedUrl.path;
+        data.protocol = parsedUrl.protocol;
+        data.headers.host = parsedUrl.host ? parsedUrl.host : parsedUrl.hostname;
+        data.port = parsedUrl.port ? parsedUrl.port : parsedUrl.port;
+
+        shim.interceptedArgs = data;
+        if (request && !lodash.isEmpty(data.headers.host) && !lodash.isEmpty(data.path)) {
+          const appUUID = API.getSecAgent().applicationInfo.applicationUUID;
+          const traceObject = secUtils.getTraceObject(shim);
+          const secMetadata = securityMetaData.getSecurityMetaData(request, data, traceObject, secUtils.getExecutionId(), EVENT_TYPE.HTTP_REQUEST, EVENT_CATEGORY.HTTP)
+          this.secEvent = API.generateSecEvent(secMetadata);
+          API.sendEvent(this.secEvent);
+
+          let traceHeader = EMPTY_STRING;
+          if (request.headers['nr-csec-tracing-data']) {
+            traceHeader = request.headers['nr-csec-tracing-data'];
+          }
+
+          if (arguments[1] instanceof Object) {
+            if (arguments[1] && arguments[1].headers && request.headers) {
+              arguments[1].headers[NRCSECTRACINGDATA] = traceHeader + appUUID + '/' + this.secEvent.apiId + '/' + this.secEvent.id + ';';
+            } else {
+              arguments[1].headers = {};
+              arguments[1].headers[NRCSECTRACINGDATA] = traceHeader + appUUID + '/' + this.secEvent.apiId + '/' + this.secEvent.id + ';';
+            }
+            if (request && request.headers[NR_CSEC_FUZZ_REQUEST_ID] && arguments[1].headers) {
+              arguments[1].headers[NR_CSEC_FUZZ_REQUEST_ID] = request.headers[NR_CSEC_FUZZ_REQUEST_ID];
+            }
+          }
+        }
+      } catch (error) {
+        logger.debug("Error while extracting undici fetch args:", error);
+      }
+      const result = fn.apply(this, arguments);
+
+      if (result && request && request.headers[NR_CSEC_FUZZ_REQUEST_ID]) {
+        API.generateExitEvent(this.secEvent);
+        delete this.secEvent
+      }
+      return result;
+    }
+  })
+}
+

package/lib/instrumentation-security/index.js

@@ -190,9 +190,65 @@ newrelic.instrumentWebframework({
   }
 })
 
+newrelic.instrumentWebframework({
+  moduleName: 'undici',
+  isEsm: true,
+  onRequire: require('./hooks/undici/nr-undici'),
+  onError: function intrumentErrorHandler(err) {
+    logger.error(err.message, err.stack)
+  }
+})
+
 
+newrelic.instrument({
+  type: 'conglomerate',
+  moduleName: '@grpc/grpc-js/build/src/server',
+  isEsm: true,
+  onRequire: require('./hooks/grpc-js/nr-grpc').wrapServer,
+  onError: function intrumentErrorHandler(err) {
+    logger.error(err.message, err.stack)
+  }
+})
 
+newrelic.instrument({
+  type: 'conglomerate',
+  moduleName: '@grpc/grpc-js/build/src/make-client',
+  isEsm: true,
+  onRequire: require('./hooks/grpc-js/nr-grpc').wrapMakeClient,
+  onError: function intrumentErrorHandler(err) {
+    logger.error(err.message, err.stack)
+  }
+})
 
+newrelic.instrument({
+  type: 'conglomerate',
+  moduleName: '@grpc/grpc-js/build/src/resolving-call',
+  isEsm: true,
+  onRequire: require('./hooks/grpc-js/nr-grpc').wrapStartResolve,
+  onError: function intrumentErrorHandler(err) {
+    logger.error(err.message, err.stack)
+  }
+})
+
+newrelic.instrument({
+  type: 'conglomerate',
+  moduleName: '@grpc/grpc-js/build/src/call-stream',
+  isEsm: true,
+  onRequire: require('./hooks/grpc-js/nr-grpc').wrapStartCall,
+  onError: function intrumentErrorHandler(err) {
+    logger.error(err.message, err.stack)
+  }
+})
+
+newrelic.instrument({
+  type: 'conglomerate',
+  moduleName: '@grpc/grpc-js',
+  isEsm: true,
+  onRequire: require('./hooks/grpc-js/nr-grpc').initialize,
+  onError: function intrumentErrorHandler(err) {
+    logger.error(err.message, err.stack)
+  }
+})
 
 
 

package/lib/nr-security-agent/lib/core/apiEndpoints.js

@@ -0,0 +1,29 @@
+
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: New Relic Software License v1.0
+ */
+
+const { BasicInfo } = require('./event');
+const applicationInfo = require('./applicationinfo').getInstance();
+/**
+ * Function Constructor to create object of FuzzFail event
+ * @param {*} fuzzHeader
+ */
+function APIEndPoint (apiEndpoints) {
+    BasicInfo.call(this);
+    this.jsonVersion = applicationInfo.jsonVersion;
+    this.jsonName = 'sec-application-url-mapping';
+    this.eventType = "sec-application-url-mapping"
+    this.applicationUUID = applicationInfo.applicationUUID;
+    this.groupName = applicationInfo.groupName;
+    this.mappings = apiEndpoints;
+
+    return this;
+}
+
+APIEndPoint.prototype.constructor = APIEndPoint;
+
+module.exports = {
+    APIEndPoint
+};

package/lib/nr-security-agent/lib/core/commonUtils.js

@@ -97,11 +97,11 @@ function runtimeSupportsAsyncFunctionGenerators() {
 function createPathIfNotExist(dir) {
     try {
         if (!fs.existsSync(dir)) {
-            fs.mkdirSync(dir, 777, { recursive: true });
+            fs.mkdirSync(dir, 770, { recursive: true });
             logger.info(dir + ' Created');
-            fs.chmodSync(dir, 0o777);
+            fs.chmodSync(dir, 0o770);
         } else {
-            fs.chmodSync(dir, 0o777);
+            fs.chmodSync(dir, 0o770);
             logger.debug(dir + ' Already Exists');
         }
     } catch (error) {
@@ -139,7 +139,7 @@ function createDirectories() {
     createPathIfNotExist(`${CSEC_HOME}${SLASH}nr-security-home${SLASH}tmp${SLASH}language-agent${SLASH}${getUUID()}`);
     createPathIfNotExist(`${CSEC_HOME}${SLASH}nr-security-home${SLASH}tmp${SLASH}language-agent${SLASH}${getUUID()}${SLASH}ds-tmp`);
     try {
-        fs.chmodSync(`${CSEC_HOME}${SLASH}nr-security-home`, 0o777);
+        fs.chmodSync(`${CSEC_HOME}${SLASH}nr-security-home`, 0o770);
     } catch (error) {
     }
 }

package/lib/nr-security-agent/lib/core/connections/grpcClient.js

@@ -0,0 +1,111 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: New Relic Pre-Release
+ */
+const logger = require('../logging').getLogger();
+const grpcutils = require('../../../../instrumentation-security/core/grpc-utils');
+const clientMap = new Map();
+let grpc;
+const { NR_CSEC_FUZZ_REQUEST_ID } = require('../../core/sec-agent-constants');
+try {
+    grpc = require("@grpc/grpc-js");
+} catch (error) {
+
+}
+
+/**
+ * Utility to get client object
+ * @param {*} config 
+ * @returns 
+ */
+function getGPRCClient(config) {
+    try {
+        const serviceName = grpcutils.getMethod(config.method).serviceName;
+
+        if (clientMap.has(serviceName)) {
+            return clientMap.get(serviceName);
+        }
+        const serviceObject = grpcutils.getService(serviceName);
+        const definition = grpc.loadPackageDefinition(serviceObject);
+        let service = getNestedValue(definition, serviceName)
+        if (service) {
+            logger.info("GRPC client service extracted successfully");
+        }
+        const client = new service(
+            "localhost:" + config.serverPort,
+            grpc.credentials.createInsecure()
+        );
+        if (!clientMap.has(serviceName)) {
+            clientMap.set(serviceName, client);
+        }
+        if(client){
+            logger.info("GRPC IAST client created successfully");
+        }
+        return client;
+    } catch (error) {
+        logger.error("error while creating client:", error);
+    }
+
+}
+
+/**
+ * Utility to fire unary requests
+ * @param {*} client 
+ * @param {*} config 
+ */
+function fireUnaryRequest(client, config) {
+    try {
+        const methodObj = grpcutils.getMethod(config.requestURI);
+        if (methodObj && methodObj.originalName) {
+            let method = methodObj.originalName;
+            let metadata = new grpc.Metadata();
+            let bufferObj = Buffer.from(config.headers[NR_CSEC_FUZZ_REQUEST_ID], "utf8");
+            let base64String = bufferObj.toString("base64");
+            metadata.add(NR_CSEC_FUZZ_REQUEST_ID, base64String);
+            client[method](JSON.parse(config.data), metadata, (err, res) => {
+                if (err) {
+                    logger.debug("Error occured:", err);
+                    return
+                }
+
+                logger.info("Fuzz success: ", JSON.stringify(config));
+                return res;
+            })
+        }
+        else {
+            logger.debug("Not Found:", config.url);
+        }
+    } catch (error) {
+        logger.debug("Error while firing Unary request:", error);
+    }
+}
+
+/**
+ * fire gRPC request based on provided config 
+ * @param {*} config 
+ * @returns 
+ */
+function fireRequest(config) {
+    let client = getGPRCClient(config);
+    fireUnaryRequest(client, config)
+}
+
+
+  function getNestedValue(obj, targetKey) {
+    for (const key in obj) {
+      if (key === targetKey) {
+        return obj[key];
+      } else if (typeof obj[key] === 'object' && obj[key] !== null) {
+        const result = getNestedValue(obj[key], targetKey);
+        if (result !== undefined) {
+          return result;
+        }
+      }
+    }
+    return undefined; // Key not found
+  }
+
+
+module.exports = {
+    fireRequest
+};

package/lib/nr-security-agent/lib/core/connections/websocket/response/fuzz-request-handler.js

@@ -7,6 +7,7 @@
 const stringify = require('fast-safe-stringify');
 
 const restClient = require('../../restclient');
+const grpcClient = require('../../grpcClient');
 const { Agent } = require('../../../agent');
 const { FuzzFailEvent } = require('../../../FuzzFailEvent');
 const { CSEC_HOME_TMP, COLON, NR_CSEC_FUZZ_REQUEST_ID, SLASH, CSEC_SEP, SEVERE } = require('../../../sec-agent-constants');
@@ -20,9 +21,6 @@ const LogMessage = require('../../../LogMessage');
 require('dns').setDefaultResultOrder('ipv4first')
 const PolicyManager = require('../../../Policy');
 
-const {
-    IS_LAMBDA_ENV,
-    AWS_LAMBDA_FUNCTION_VERSION_ENV_IDENTIFIER } = require('../../../sec-agent-constants');
 const statusUtils = require('../../../statusUtils');
 
 const find = `${SLASH}{{NR_CSEC_VALIDATOR_HOME_TMP}}`;
@@ -125,13 +123,16 @@ function handler(json) {
 function handleFuzzRequest(fuzzDetails) {
     const { fuzzRequest } = fuzzDetails;
     try {
-        if (IS_LAMBDA_ENV) {
-            const qualifiedARN = Agent.getAgent().applicationInfo.applicationUUID;
-            const splitArn = String.prototype.split.call(qualifiedARN, ':');
-            const arn = splitArn.slice(0, splitArn.length - 1).join(':');
-            const ver = process.env[AWS_LAMBDA_FUNCTION_VERSION_ENV_IDENTIFIER];
-            logger.info('Invoking Lambda:: ARN: ' + arn);
-            logger.info('Invoking Lambda:: Version: ' + ver);
+        if (fuzzRequest.protocol == 'grpc') {
+            const config = parseGRPCRequestToFuzz(fuzzRequest);
+            config.headers['nr-csec-parent-id'] = fuzzRequest.id;
+            IASTUtil.completedRequestsMapInit(fuzzRequest.id);
+            grpcClient.fireRequest(config);
+            if (fuzzRequest.headers && fuzzRequest.headers[NR_CSEC_FUZZ_REQUEST_ID]) {
+                logScannedApiId(fuzzRequest.headers[NR_CSEC_FUZZ_REQUEST_ID], fuzzRequest.requestURI)
+            }
+
+            IASTUtil.removePendingRequestId(fuzzRequest.id);
 
         } else {
             const config = parseAxiosHttpRequestToFuzz(fuzzRequest);
@@ -153,7 +154,6 @@ function handleFuzzRequest(fuzzDetails) {
 
 
             logger.info('Firing http request:: URL: ' + config.url);
-
             const response = restClient.fireRequest(config);
             handleFuzzResponse(response, fuzzDetails);
         }
@@ -210,6 +210,26 @@ function parseAxiosHttpRequestToFuzz(requestObject) {
     };
 }
 
+/**
+ * Parses the passed fuzz request object to
+ * Axios config.
+ *
+ * @param {JSON} requestObject
+ */
+function parseGRPCRequestToFuzz(requestObject) {
+    let serverName = requestObject.serverName ? requestObject.serverName : LOCALHOST;
+    let host = serverName + COLON + requestObject.serverPort
+    return {
+        url: requestObject.protocol + COLON_SLASH_SLASH + host + requestObject.url,
+        requestURI: requestObject.requestURI,
+        protocol: requestObject.protocol,
+        serverPort: requestObject.serverPort,
+        method: requestObject.method,
+        data: requestObject.body,
+        headers: requestObject.headers,
+        timeout: 5000,
+    };
+}
 
 
 /**

package/lib/nr-security-agent/lib/core/logging.js

@@ -31,11 +31,11 @@ const CSEC_ROOT = `${CSEC_HOME}${sep}nr-security-home${sep}`;
 function createLogPathIfNotExist(dir) {
     try {
         if (!fs.existsSync(dir)) {
-            fs.mkdirSync(dir, 777, { recursive: true });
-            fs.chmodSync(dir, 0o777);
+            fs.mkdirSync(dir, 770, { recursive: true });
+            fs.chmodSync(dir, 0o770);
         }
         else {
-            fs.chmodSync(dir, 0o777);
+            fs.chmodSync(dir, 0o770);
         }
     } catch (error) {
     }
@@ -168,8 +168,8 @@ function getLogger(applicationUUID = process.env.applicationUUID) {
         logger = log4js.getLogger('NR_CSEC');
         const initLogger = getInitLogger();
         try {
-            fs.chmodSync(`${logFileName}`, 0o777);
-            fs.chmodSync(`${initLogFileName}`, 0o777);
+            fs.chmodSync(`${logFileName}`, 0o660);
+            fs.chmodSync(`${initLogFileName}`, 0o660);
         } catch (error) {
         }
         initLogger.info("[STEP-2] => Generating unique identifier:", applicationUUID)

package/lib/nr-security-agent/lib/core/statusUtils.js

@@ -93,7 +93,7 @@ function getFormattedData() {
 function writeSnapshot() {
     const snapshot = getFormattedData();
     commonUtils.removeOlderSnapshots();
-    fs.writeFile(statusFile, snapshot, { mode: 0o777 }, function (err) {
+    fs.writeFile(statusFile, snapshot, { mode: 0o660 }, function (err) {
         if (err) {
             logger.debug(err.message);
             const LogMessage = require('./LogMessage');
@@ -101,7 +101,7 @@ function writeSnapshot() {
             commonUtils.addLogEventtoBuffer(logMessage);
         } else {
             logger.info('Snapshot updated to file: %s', statusFile);
-            fs.chmod(statusFile, 0o777, (err) => {
+            fs.chmod(statusFile, 0o660, (err) => {
                 if (err) {
                     addErrortoBuffer(err);
                 }

package/lib/nr-security-agent/lib/core/websocket-client.js

@@ -70,6 +70,15 @@ const initialize = function () {
     setTimeout(() => {
         setInterval(sendHC, HC_INTERVAL_MS);
         sendHC();
+        try {
+            let apiEndpoints =  require('../../../instrumentation-security/core/route-manager').getAllAPIEndPoints();
+            let data  = require('./apiEndpoints').APIEndPoint(apiEndpoints);
+            logger.debug("All API end points of the application is:",JSON.stringify(data));
+            getDispatcherAndSendEvent(data);
+        } catch (error) {
+            logger.debug("Error while processing API endpoints",error);
+        }
+       
         try {
             const framework = NRAgent.environment.get('Framework')[0];
             const dispatcher = NRAgent.environment.get('Dispatcher')[0];
@@ -78,8 +87,8 @@ const initialize = function () {
         } catch (error) {
             logger.debug("Error while extracting data from APM environment",error);
         }
+    }, 20000);
 
-    }, 30000);
 
     setInterval(commonUtils.logRollOver, 30000);
     initLogger.info("[STEP-5] => Security Agent components started");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@newrelic/security-agent",
-  "version": "1.0.1",
+  "version": "1.1.0",
   "description": "New Relic Security Agent for Node.js",
   "main": "index.js",
   "jsonVersion": "1.1.1",
@@ -35,7 +35,7 @@
     "url": "https://github.com/newrelic/csec-node-agent.git"
   },
   "dependencies": {
-    "axios": "^1.6.5",
+    "axios": "^1.6.8",
     "check-disk-space": "^3.4.0",
     "content-type": "^1.0.5",
     "fast-safe-stringify": "^2.1.1",
@@ -58,6 +58,8 @@
     "ws": "^8.14.2"
   },
   "devDependencies": {
+    "@grpc/grpc-js": "^1.9.5",
+    "@grpc/proto-loader": "^0.7.10",
     "@hapi/hapi": "^21.3.0",
     "@koa/router": "^12.0.0",
     "@newrelic/newrelic-oss-cli": "^0.1.2",
@@ -84,7 +86,9 @@
     "request": "^2.88.2",
     "restify": "^11.1.0",
     "sinon": "^15.0.0",
+    "stream": "^0.0.2",
     "tap": "^16.3.2",
+    "undici": "^5.28.0",
     "xmldom": "^0.6.0",
     "xpath": "^0.0.32",
     "xpath.js": "^1.1.0"