@newrelic/security-agent 1.1.1 → 1.3.0

package/lib/nr-security-agent/lib/core/connections/websocket/response/fuzz-request-handler.js

@@ -7,6 +7,7 @@
 const stringify = require('fast-safe-stringify');
 
 const restClient = require('../../restclient');
+const grpcClient = require('../../grpcClient');
 const { Agent } = require('../../../agent');
 const { FuzzFailEvent } = require('../../../FuzzFailEvent');
 const { CSEC_HOME_TMP, COLON, NR_CSEC_FUZZ_REQUEST_ID, SLASH, CSEC_SEP, SEVERE } = require('../../../sec-agent-constants');
@@ -20,9 +21,6 @@ const LogMessage = require('../../../LogMessage');
 require('dns').setDefaultResultOrder('ipv4first')
 const PolicyManager = require('../../../Policy');
 
-const {
-    IS_LAMBDA_ENV,
-    AWS_LAMBDA_FUNCTION_VERSION_ENV_IDENTIFIER } = require('../../../sec-agent-constants');
 const statusUtils = require('../../../statusUtils');
 
 const find = `${SLASH}{{NR_CSEC_VALIDATOR_HOME_TMP}}`;
@@ -53,7 +51,7 @@ function startIASTSchedular() {
     if (isNaN(probingInterval)) {
         probingInterval = 5;
     }
-
+    
     iastIntervalConst = setInterval(() => {
         let data = IASTUtil.generateIASTDataRequest();
         let currentTime = Date.now();
@@ -125,13 +123,16 @@ function handler(json) {
 function handleFuzzRequest(fuzzDetails) {
     const { fuzzRequest } = fuzzDetails;
     try {
-        if (IS_LAMBDA_ENV) {
-            const qualifiedARN = Agent.getAgent().applicationInfo.applicationUUID;
-            const splitArn = String.prototype.split.call(qualifiedARN, ':');
-            const arn = splitArn.slice(0, splitArn.length - 1).join(':');
-            const ver = process.env[AWS_LAMBDA_FUNCTION_VERSION_ENV_IDENTIFIER];
-            logger.info('Invoking Lambda:: ARN: ' + arn);
-            logger.info('Invoking Lambda:: Version: ' + ver);
+        if (fuzzRequest.protocol == 'grpc') {
+            const config = parseGRPCRequestToFuzz(fuzzRequest);
+            config.headers['nr-csec-parent-id'] = fuzzRequest.id;
+            IASTUtil.completedRequestsMapInit(fuzzRequest.id);
+            grpcClient.fireRequest(config);
+            if (fuzzRequest.headers && fuzzRequest.headers[NR_CSEC_FUZZ_REQUEST_ID]) {
+                logScannedApiId(fuzzRequest.headers[NR_CSEC_FUZZ_REQUEST_ID], fuzzRequest.requestURI)
+            }
+
+            IASTUtil.removePendingRequestId(fuzzRequest.id);
 
         } else {
             const config = parseAxiosHttpRequestToFuzz(fuzzRequest);
@@ -153,7 +154,6 @@ function handleFuzzRequest(fuzzDetails) {
 
 
             logger.info('Firing http request:: URL: ' + config.url);
-
             const response = restClient.fireRequest(config);
             handleFuzzResponse(response, fuzzDetails);
         }
@@ -210,6 +210,26 @@ function parseAxiosHttpRequestToFuzz(requestObject) {
     };
 }
 
+/**
+ * Parses the passed fuzz request object to
+ * Axios config.
+ *
+ * @param {JSON} requestObject
+ */
+function parseGRPCRequestToFuzz(requestObject) {
+    let serverName = requestObject.serverName ? requestObject.serverName : LOCALHOST;
+    let host = serverName + COLON + requestObject.serverPort
+    return {
+        url: requestObject.protocol + COLON_SLASH_SLASH + host + requestObject.url,
+        requestURI: requestObject.requestURI,
+        protocol: requestObject.protocol,
+        serverPort: requestObject.serverPort,
+        method: requestObject.method,
+        data: requestObject.body,
+        headers: requestObject.headers,
+        timeout: 5000,
+    };
+}
 
 
 /**

package/lib/nr-security-agent/lib/core/connections/websocket/response/startup-handshake-handler.js

@@ -18,7 +18,7 @@ module.exports.handler = function handler(json) {
       
         initLogger.info(LOG_MESSAGES.AGENT_INIT_WITH_PROP, JSON.stringify(startupConfig.config));
         initLogger.info('Security Agent is now ACTIVE for', applicationInfoModule.getInstance().applicationUUID);
-        const logMessage = new LogMessage.logMessage("SEVERE", `Security Agent is ACTIVE for ${ applicationInfoModule.getInstance().applicationUUID}`, __filename, null);
+        const logMessage = new LogMessage.logMessage("INFO", `Security Agent is ACTIVE for ${ applicationInfoModule.getInstance().applicationUUID}`, __filename, null);
         require('../../../commonUtils').addLogEventtoBuffer(logMessage);
 
     } catch (error) {

package/lib/nr-security-agent/lib/core/connections/websocket/websocket.js

@@ -104,6 +104,7 @@ SecWebSocket.prototype.init = function init() {
     const validatorService = commonUtils.getValidatorServiceEndpointURL();
     const authHeaders = require('../../Auth-headers').getInstance();
     initLogger.info(`Connecting to Validator at ${validatorService}`);
+    IASTUtil.IASTCleanup();
     let cert = ''
     try {
         const certPath = commonUtils.getPathOfCACert();
@@ -138,6 +139,7 @@ SecWebSocket.prototype.init = function init() {
     })
     webSocket.on('close', () => {
         logger.warn("WS connection closed");
+        this.obeyReconnect();
     })
     this.instance = webSocket;
 };
@@ -172,7 +174,7 @@ SecWebSocket.prototype.obeyReconnect = function obeyReconnect() {
     }
 
     initTimeOut = setTimeout(() => {
-        IASTUtil.IASTCleanup();
+
         logger.debug("Terminating ws instance and reconnecting");
         try {
             instance.terminate();
@@ -189,18 +191,21 @@ SecWebSocket.prototype.pingWS = async function pingWS() {
     let currentTime = Date.now();
 
     let timeDiffInPing = (currentTime - lastPongtime) / 1000;
-    if (timeDiffInPing > 40 && lastPongtime != 0) {
+    logger.debug("Websocket ready state is:",self.instance.readyState)
+    
+    if (timeDiffInPing > 40 && lastPongtime != 0 && self.instance.readyState > 1) {
         self.obeyReconnect();
         lastPongtime = 0;
         return;
     }
+
     try {
         await promisify(self.instance, self.instance.ping)(ACK, true, function (err) {
             if (err) {
                 logger.debug("Error while pinging:", err);
                 commonUtils.setWSHealthStatus('Error');
                 statusUtils.addErrortoBuffer(err);
-                self.obeyReconnect();
+    
             }
         });
     } catch (err) {
@@ -258,7 +263,7 @@ SecWebSocket.prototype.dispatch = async function dispatch(event) {
                 hc.getInstance().exitEventStats.sent++;
             }
 
-        });
+        })
     } catch (error) {
         logger.debug(LOG_MESSAGES.ERROR_WHILE_SEND_EVENT, eventStr, error);
         statusUtils.addErrortoBuffer(error);

package/lib/nr-security-agent/lib/core/sec-agent-constants.js

@@ -111,6 +111,7 @@ module.exports = {
     SEVERE: 'SEVERE',
     HIGH: 'HIGH',
     CRITICAL: 'CRITICAL',
+    HYPHEN: '-',
 
     LOG_MESSAGES: {
         LOADED_CSEC_ENVS_MSG: '[STEP-1][COMPLETE][env] Environment Information Gathering Done.',
@@ -165,7 +166,7 @@ module.exports = {
         ERROR_WHILE_SEND_EVENT: 'ERROR While Sending Event: {}',
         WS_CONNECTED: '[STEP-4][COMPLETE][WS] Connected To Prevent-web Service',
         SENDING_APPINFO: '[APP_INFO] Sending Application Info To Prevent-web Service: ',
-        SENDING_APPINFO_COMPLETE: '[COMPLETE][APP_INFO] Application info sent to Prevent-Web service :',
+        SENDING_APPINFO_COMPLETE: '[STEP-3][COMPLETE][APP_INFO] Application info sent to Prevent-Web service :',
         APPLY_INSTRUMENTATION: '[STEP-6][BEGIN][instrumentation] Applying Instrumentation',
         AVAIL_DISK: 'Available Disk Space Is: ',
         AVAIL_DISK_ERROR: 'Insufficient Disk Space Available To The Location %s Is : %s',

package/lib/nr-security-agent/lib/core/sec-util.js

@@ -9,7 +9,7 @@ const { SecEvent } = require('./event');
 const logs = require('./logging');
 const { Agent } = require('./agent');
 const shaUtil = require('./sha-size-util');
-const { LOG_MESSAGES, NR_CSEC_FUZZ_REQUEST_ID, COLON, VULNERABLE, EXITEVENT, EMPTY_STR, RASP, SEVERE } = require('./sec-agent-constants');
+const { LOG_MESSAGES, NR_CSEC_FUZZ_REQUEST_ID, COLON, VULNERABLE, EXITEVENT, EMPTY_STR, RASP, SEVERE, HYPHEN } = require('./sec-agent-constants');
 const API = require('../../../nr-security-api');
 const NRAgent = API.getNRAgent();
 const HC = require('./health-check');
@@ -83,6 +83,7 @@ function generateSecEvent(securityMetadata) {
         }
 
         let apiId = shaUtil.getSHA256ForData(traceObject.stacktrace.join('|') + uri);
+        apiId = securityMetadata.eventType + HYPHEN + apiId;
         const agentModule = Agent.getAgent();
         const metaData = {};
         if (traceObject.sourceDetails && traceObject.sourceDetails.evalObj) {
@@ -100,6 +101,7 @@ function generateSecEvent(securityMetadata) {
         const isAPIBlocked = false;
         const event = new SecEvent(traceObject.sourceDetails.fileName, traceObject.sourceDetails.funcName, traceObject.sourceDetails.lineNumber, securityMetadata.interceptedArgs, securityMetadata.executionId, agentModule.applicationInfo, securityMetadata.request, securityMetadata.eventType, traceObject.sourceDetails.source, securityMetadata.eventCategory, metaData, stakTrace, apiId, isAPIBlocked);
         event.metaData.isClientDetectedFromXFF = isClientDetectedFromXFF;
+        event.httpRequest.route = uri;
         return event;
     } catch (e) {
         statusUtils.addErrortoBuffer(e);

package/lib/nr-security-agent/lib/core/statusUtils.js

@@ -23,10 +23,11 @@ const logs = require('./logging');
 const commonUtils = require('./commonUtils');
 const logger = logs.getLogger();
 const statusFile = njsAgentConstants.STATUS_LOG_FILE;
+const sep = require('path').sep;
 
 const statusTemplate = 'Snapshot timestamp: : %s\n' +
     `CSEC Agent start timestamp: ${njsAgentConstants.AGENT_START_TIME} with application uuid:${commonUtils.getUUID()}\n` +
-    `SEC_HOME: ${njsAgentConstants.CSEC_HOME}\n` +
+    `CSEC_HOME: ${njsAgentConstants.CSEC_HOME}${sep}nr-security-home${sep}\n` +
     `Agent location: ${AGENT_DIR}\n` +
     `Using CSEC Agent for Node.js, Node version:${process.version}, PID:${process.pid}\n` +
     `Process title: ${process.title}\n` +
@@ -35,10 +36,10 @@ const statusTemplate = 'Snapshot timestamp: : %s\n' +
     `Current working directory: ${process.cwd()}\n` +
     `Agent mode: ${commonUtils.getCSECmode()}\n` +
     'Application server: %s\n' +
-    'Application Framework: %s\n' +
+    `Application Framework: %s\n` +
     `Websocket connection to Prevent Web: ${commonUtils.getValidatorServiceEndpointURL()}, Status: %s\n` +
-    'Instrumentation successful:\n' +
-    'Tracking loaded modules in the application:\n' +
+    'Instrumentation successful\n' +
+    'Tracking loaded modules in the application\n' +
     'Policy applied successfully. Policy version is: %s\n' +
     'Started Health Check for Agent\n' +
     'Started Inbound and Outbound monitoring \n' +
@@ -83,7 +84,7 @@ function getFormattedData() {
     const appInfo = Agent.applicationInfo;
     const deployedApplications = appInfo && appInfo.serverInfo && appInfo.serverInfo.deployedApplications;
     const appLoc = deployedApplications[0].deployedPath;
-    const formattedSnapshot = util.format(statusTemplate, new Date().toString(), appLoc, appInfo.serverInfo.name, njsAgentConstants.FRAMEWORK, commonUtils.getWSHealthStatus(), appInfo.policyVersion, getKeyValPairs(lastHC.stats), getKeyValPairs(lastHC.serviceStatus), JSON.stringify(getBufferedErrors()), JSON.stringify(getBufferedHC()));
+    const formattedSnapshot = util.format(statusTemplate, new Date().toString(), appLoc, appInfo.serverInfo.name, commonUtils.getFramework(), commonUtils.getWSHealthStatus(), appInfo.policyVersion, getKeyValPairs(lastHC.stats), getKeyValPairs(lastHC.serviceStatus), JSON.stringify(getBufferedErrors()), JSON.stringify(getBufferedHC()));
     return formattedSnapshot;
 }
 
@@ -97,7 +98,7 @@ function writeSnapshot() {
         if (err) {
             logger.debug(err.message);
             const LogMessage = require('./LogMessage');
-            const logMessage = new LogMessage.logMessage("SEVERE", 'Error in creating snapshot file', __filename, err);
+            const logMessage = new LogMessage.logMessage("DEBUG", 'Error in creating snapshot file', __filename, err);
             commonUtils.addLogEventtoBuffer(logMessage);
         } else {
             logger.info('Snapshot updated to file: %s', statusFile);

package/lib/nr-security-agent/lib/core/websocket-client.js

@@ -82,7 +82,7 @@ const initialize = function () {
         try {
             const framework = NRAgent.environment.get('Framework')[0];
             const dispatcher = NRAgent.environment.get('Dispatcher')[0];
-            const logMessage = new LogMessage.logMessage("SEVERE", `Detected framework: ${framework} and dispatcher: ${dispatcher}`, __filename, null);
+            const logMessage = new LogMessage.logMessage("INFO", `Detected framework: ${framework} and dispatcher: ${dispatcher}`, __filename, null);
             commonUtils.addLogEventtoBuffer(logMessage);
         } catch (error) {
             logger.debug("Error while extracting data from APM environment",error);

package/lib/nr-security-agent/lib/core/xss-utils.js

@@ -10,6 +10,7 @@ const querystring = require('querystring');
 const { Agent } = require('./agent');
 
 const htmlEntities = require('html-entities');
+const { STRING } = require('./sec-agent-constants');
 
 const tagNameRegex = /<([a-zA-Z_-]+[0-9]*|!--)/gmi;
 const attribRegex = /([^(/\s<'">)]+?)(?:\s*)=\s*(('|")([\s\S]*?)(?:(?=(\\?))\5.)*?\3|.+?(?=\/>|>|\?>|\s|<\/|$))/gmi;
@@ -136,10 +137,15 @@ function decodeResponseData (responseBody, responseHeaders) {
 
 function isXSS (combinedData) {
     const attackConstructs = new Set();
-    for (const data of combinedData) {
-        const constructs = getXSSConstructs(data);
-        constructs.forEach(attackConstructs.add, attackConstructs);
+    try {
+        for (const data of combinedData) {
+            const constructs = getXSSConstructs(data);
+            constructs.forEach(attackConstructs.add, attackConstructs);
+        }
+    } catch (error) {
+        logger.debug("Error while getting rxss constucts:", error);
     }
+    
     return attackConstructs;
 }
 
@@ -152,7 +158,7 @@ function getXSSConstructs (data) {
     let tmpStartPos = 0;
     let matcher;
     let attribMatcher;
-    while (currPos < data.length) {
+    while (currPos < data.length && typeof data == STRING ) {
         let tagName;
 
         matcher = tagNameRegex.exec(data);
@@ -233,7 +239,7 @@ function getXSSConstructs (data) {
             currPos = tmpCurrPos;
         }
 
-        if (data.charAt(currPos) !== ANGLE_END_CHAR) {
+        if (typeof data == STRING && data.charAt(currPos) !== ANGLE_END_CHAR) {
             const tmp = data.indexOf(ANGLE_END, currPos);
             if (tmp !== -1) {
                 currPos = tmp;

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@newrelic/security-agent",
-  "version": "1.1.1",
+  "version": "1.3.0",
   "description": "New Relic Security Agent for Node.js",
   "main": "index.js",
-  "jsonVersion": "1.1.1",
+  "jsonVersion": "1.2.0",
   "contributors": [
     {
       "name": "Sumit Suthar",
@@ -58,6 +58,7 @@
     "ws": "^8.14.2"
   },
   "devDependencies": {
+    "@grpc/proto-loader": "^0.7.10",
     "@hapi/hapi": "^21.3.0",
     "@koa/router": "^12.0.0",
     "@newrelic/newrelic-oss-cli": "^0.1.2",