@newrelic/security-agent 1.2.0 → 1.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +12 -0
- package/README.md +1 -1
- package/THIRD_PARTY_NOTICES.md +210 -209
- package/lib/instrumentation-security/core/grpc-utils.js +53 -0
- package/lib/instrumentation-security/core/security-metadata.js +12 -2
- package/lib/instrumentation-security/hooks/fs/nr-fs.js +4 -4
- package/lib/instrumentation-security/hooks/grpc-js/nr-grpc.js +301 -0
- package/lib/instrumentation-security/index.js +32 -3
- package/lib/nr-security-agent/index.js +7 -1
- package/lib/nr-security-agent/lib/core/commonUtils.js +2 -2
- package/lib/nr-security-agent/lib/core/connections/grpcClient.js +112 -0
- package/lib/nr-security-agent/lib/core/connections/websocket/response/IASTUtils.js +3 -0
- package/lib/nr-security-agent/lib/core/connections/websocket/response/fuzz-request-handler.js +32 -12
- package/lib/nr-security-agent/lib/core/connections/websocket/response/startup-handshake-handler.js +1 -1
- package/lib/nr-security-agent/lib/core/connections/websocket/websocket.js +9 -4
- package/lib/nr-security-agent/lib/core/sec-util.js +1 -0
- package/lib/nr-security-agent/lib/core/statusUtils.js +1 -1
- package/lib/nr-security-agent/lib/core/websocket-client.js +1 -1
- package/lib/nr-security-agent/lib/core/xss-utils.js +11 -5
- package/package.json +2 -1
|
@@ -10,6 +10,7 @@ const querystring = require('querystring');
|
|
|
10
10
|
const { Agent } = require('./agent');
|
|
11
11
|
|
|
12
12
|
const htmlEntities = require('html-entities');
|
|
13
|
+
const { STRING } = require('./sec-agent-constants');
|
|
13
14
|
|
|
14
15
|
const tagNameRegex = /<([a-zA-Z_-]+[0-9]*|!--)/gmi;
|
|
15
16
|
const attribRegex = /([^(/\s<'">)]+?)(?:\s*)=\s*(('|")([\s\S]*?)(?:(?=(\\?))\5.)*?\3|.+?(?=\/>|>|\?>|\s|<\/|$))/gmi;
|
|
@@ -136,10 +137,15 @@ function decodeResponseData (responseBody, responseHeaders) {
|
|
|
136
137
|
|
|
137
138
|
function isXSS (combinedData) {
|
|
138
139
|
const attackConstructs = new Set();
|
|
139
|
-
|
|
140
|
-
const
|
|
141
|
-
|
|
140
|
+
try {
|
|
141
|
+
for (const data of combinedData) {
|
|
142
|
+
const constructs = getXSSConstructs(data);
|
|
143
|
+
constructs.forEach(attackConstructs.add, attackConstructs);
|
|
144
|
+
}
|
|
145
|
+
} catch (error) {
|
|
146
|
+
logger.debug("Error while getting rxss constucts:", error);
|
|
142
147
|
}
|
|
148
|
+
|
|
143
149
|
return attackConstructs;
|
|
144
150
|
}
|
|
145
151
|
|
|
@@ -152,7 +158,7 @@ function getXSSConstructs (data) {
|
|
|
152
158
|
let tmpStartPos = 0;
|
|
153
159
|
let matcher;
|
|
154
160
|
let attribMatcher;
|
|
155
|
-
while (currPos < data.length) {
|
|
161
|
+
while (currPos < data.length && typeof data == STRING ) {
|
|
156
162
|
let tagName;
|
|
157
163
|
|
|
158
164
|
matcher = tagNameRegex.exec(data);
|
|
@@ -233,7 +239,7 @@ function getXSSConstructs (data) {
|
|
|
233
239
|
currPos = tmpCurrPos;
|
|
234
240
|
}
|
|
235
241
|
|
|
236
|
-
if (data.charAt(currPos) !== ANGLE_END_CHAR) {
|
|
242
|
+
if (typeof data == STRING && data.charAt(currPos) !== ANGLE_END_CHAR) {
|
|
237
243
|
const tmp = data.indexOf(ANGLE_END, currPos);
|
|
238
244
|
if (tmp !== -1) {
|
|
239
245
|
currPos = tmp;
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@newrelic/security-agent",
|
|
3
|
-
"version": "1.
|
|
3
|
+
"version": "1.3.0",
|
|
4
4
|
"description": "New Relic Security Agent for Node.js",
|
|
5
5
|
"main": "index.js",
|
|
6
6
|
"jsonVersion": "1.2.0",
|
|
@@ -58,6 +58,7 @@
|
|
|
58
58
|
"ws": "^8.14.2"
|
|
59
59
|
},
|
|
60
60
|
"devDependencies": {
|
|
61
|
+
"@grpc/proto-loader": "^0.7.10",
|
|
61
62
|
"@hapi/hapi": "^21.3.0",
|
|
62
63
|
"@koa/router": "^12.0.0",
|
|
63
64
|
"@newrelic/newrelic-oss-cli": "^0.1.2",
|