@newrelic/security-agent 1.2.0 → 1.4.0

package/lib/nr-security-agent/lib/core/LogMessage.js

@@ -20,10 +20,11 @@ function logMessageException(exception) {
     try {
         exceptionObject.message = exception.message ? exception.message : '';
         exceptionObject.cause = null;
+        exceptionObject.type = exception.name;
         if (exception.stack) {
             let stacktraceInList = exception.stack.split('\n');
             stacktraceInList = stacktraceInList.slice(1);
-            exceptionObject.stacktrace = stacktraceInList;
+            exceptionObject.stackTrace = stacktraceInList;
         }
 
     } catch (error) {
@@ -51,6 +52,8 @@ function logMessage(level, message, caller, exception) {
         this.applicationUUID = applicationInfo.applicationUUID;
         this.groupName = applicationInfo.groupName;
         this.policyVersion = applicationInfo.policyVersion;
+        this.collectorVersion = applicationInfo.collectorVersion ? applicationInfo.collectorVersion : null;
+        this.buildNumber = applicationInfo.buildNumber ? applicationInfo.buildNumber : null;
         this.timestamp = Date.now();
         this.level = level ? level : 'SEVERE';
         this.message = message;

package/lib/nr-security-agent/lib/core/commonUtils.js

@@ -107,7 +107,7 @@ function createPathIfNotExist(dir) {
     } catch (error) {
         logger.debug(dir + ' Not Created', error);
         const LogMessage = require('./LogMessage');
-        const logMessage = new LogMessage.logMessage("SEVERE", 'Error in creating directory', __filename, error);
+        const logMessage = new LogMessage.logMessage("DEBUG", 'Error in creating directory', __filename, error);
         addLogEventtoBuffer(logMessage);
     }
 }
@@ -288,7 +288,7 @@ function removeOlderSnapshots() {
     } catch (error) {
         logger.debug(error);
         const LogMessage = require('./LogMessage');
-        const logMessage = new LogMessage.logMessage("SEVERE", 'Error in processing snapshot files', __filename, error);
+        const logMessage = new LogMessage.logMessage("DEBUG", 'Error in processing snapshot files', __filename, error);
         addLogEventtoBuffer(logMessage);
     }
 }

package/lib/nr-security-agent/lib/core/connections/grpcClient.js

@@ -0,0 +1,112 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: New Relic Pre-Release
+ */
+const logger = require('../logging').getLogger();
+const grpcutils = require('../../../../instrumentation-security/core/grpc-utils');
+const clientMap = new Map();
+let grpc;
+const { NR_CSEC_FUZZ_REQUEST_ID } = require('../../core/sec-agent-constants');
+
+/**
+ * Utility to get client object
+ * @param {*} config 
+ * @returns 
+ */
+function getGPRCClient(config) {
+    let grpc = require("@grpc/grpc-js");
+    try {
+        const serviceName = grpcutils.getMethod(config.method).serviceName;
+
+        if (clientMap.has(serviceName)) {
+            return clientMap.get(serviceName);
+        }
+        const serviceObject = grpcutils.getService(serviceName);
+        const definition = grpc.loadPackageDefinition(serviceObject);
+        let service = getNestedValue(definition, serviceName)
+        if (service) {
+            logger.info("GRPC client service extracted successfully");
+        }
+        const client = new service(
+            "localhost:" + config.serverPort,
+            grpc.credentials.createInsecure()
+        );
+        if (!clientMap.has(serviceName)) {
+            clientMap.set(serviceName, client);
+        }
+        if(client){
+            logger.info("GRPC IAST client created successfully");
+        }
+        return client;
+    } catch (error) {
+        logger.error("error while creating client:", error);
+    }
+
+}
+
+/**
+ * Utility to fire unary requests
+ * @param {*} client 
+ * @param {*} config 
+ */
+function fireUnaryRequest(client, config) {
+    try {
+        const methodObj = grpcutils.getMethod(config.requestURI);
+        if (methodObj && methodObj.originalName) {
+            let method = methodObj.originalName;
+            let metadata = new grpc.Metadata();
+            let bufferObj = Buffer.from(config.headers[NR_CSEC_FUZZ_REQUEST_ID], "utf8");
+            let base64String = bufferObj.toString("base64");
+            metadata.add(NR_CSEC_FUZZ_REQUEST_ID, base64String);
+            client[method](JSON.parse(config.data), metadata, (err, res) => {
+                if (err) {
+                    logger.debug("Error occured:", err);
+                    return
+                }
+
+                logger.info("Fuzz success: ", JSON.stringify(config));
+                return res;
+            })
+        }
+        else {
+            logger.debug("Not Found:", config.url);
+        }
+    } catch (error) {
+        logger.debug("Error while firing Unary request:", error);
+    }
+}
+
+/**
+ * fire gRPC request based on provided config 
+ * @param {*} config 
+ * @returns 
+ */
+function fireRequest(config) {
+    try {
+        grpc = require("@grpc/grpc-js");
+    } catch (error) {
+        logger.debug("Unable to import grpc module", error);
+    }
+    let client = getGPRCClient(config);
+    fireUnaryRequest(client, config)
+}
+
+
+  function getNestedValue(obj, targetKey) {
+    for (const key in obj) {
+      if (key === targetKey) {
+        return obj[key];
+      } else if (typeof obj[key] === 'object' && obj[key] !== null) {
+        const result = getNestedValue(obj[key], targetKey);
+        if (result !== undefined) {
+          return result;
+        }
+      }
+    }
+    return undefined; // Key not found
+  }
+
+
+module.exports = {
+    fireRequest
+};

package/lib/nr-security-agent/lib/core/connections/restclient.js

@@ -12,6 +12,12 @@ const axios = require('axios').default;
  */
 function fireRequest (config) {
     axios.defaults.timeout = 5000;
+    axios.defaults.headers.common['user-agent'] = null;
+    axios.defaults.headers.common['accept-encoding'] = null;
+    axios.defaults.headers.common['connection'] = null;
+    axios.defaults.headers.common['sec-ch-ua-platform'] = null;
+    axios.defaults.headers.common['accept'] = null;
+    axios.defaults.headers.common['content-type'] = null;
     return axios(config);
 }
 

package/lib/nr-security-agent/lib/core/connections/websocket/response/IASTUtils.js

@@ -31,6 +31,9 @@ function completedRequestsMapInit(id) {
 
 function addCompletedRequests(id, eventId) {
     let data = completedRequestsMap.get(id);
+    if(!data){
+        return;
+    }
     data.push(eventId);
     completedRequestsMap.set(id, data);
 }

package/lib/nr-security-agent/lib/core/connections/websocket/response/fuzz-request-handler.js

@@ -7,6 +7,7 @@
 const stringify = require('fast-safe-stringify');
 
 const restClient = require('../../restclient');
+const grpcClient = require('../../grpcClient');
 const { Agent } = require('../../../agent');
 const { FuzzFailEvent } = require('../../../FuzzFailEvent');
 const { CSEC_HOME_TMP, COLON, NR_CSEC_FUZZ_REQUEST_ID, SLASH, CSEC_SEP, SEVERE } = require('../../../sec-agent-constants');
@@ -20,9 +21,6 @@ const LogMessage = require('../../../LogMessage');
 require('dns').setDefaultResultOrder('ipv4first')
 const PolicyManager = require('../../../Policy');
 
-const {
-    IS_LAMBDA_ENV,
-    AWS_LAMBDA_FUNCTION_VERSION_ENV_IDENTIFIER } = require('../../../sec-agent-constants');
 const statusUtils = require('../../../statusUtils');
 
 const find = `${SLASH}{{NR_CSEC_VALIDATOR_HOME_TMP}}`;
@@ -53,7 +51,7 @@ function startIASTSchedular() {
     if (isNaN(probingInterval)) {
         probingInterval = 5;
     }
-
+    
     iastIntervalConst = setInterval(() => {
         let data = IASTUtil.generateIASTDataRequest();
         let currentTime = Date.now();
@@ -125,13 +123,16 @@ function handler(json) {
 function handleFuzzRequest(fuzzDetails) {
     const { fuzzRequest } = fuzzDetails;
     try {
-        if (IS_LAMBDA_ENV) {
-            const qualifiedARN = Agent.getAgent().applicationInfo.applicationUUID;
-            const splitArn = String.prototype.split.call(qualifiedARN, ':');
-            const arn = splitArn.slice(0, splitArn.length - 1).join(':');
-            const ver = process.env[AWS_LAMBDA_FUNCTION_VERSION_ENV_IDENTIFIER];
-            logger.info('Invoking Lambda:: ARN: ' + arn);
-            logger.info('Invoking Lambda:: Version: ' + ver);
+        if (fuzzRequest.protocol == 'grpc') {
+            const config = parseGRPCRequestToFuzz(fuzzRequest);
+            config.headers['nr-csec-parent-id'] = fuzzRequest.id;
+            IASTUtil.completedRequestsMapInit(fuzzRequest.id);
+            grpcClient.fireRequest(config);
+            if (fuzzRequest.headers && fuzzRequest.headers[NR_CSEC_FUZZ_REQUEST_ID]) {
+                logScannedApiId(fuzzRequest.headers[NR_CSEC_FUZZ_REQUEST_ID], fuzzRequest.requestURI)
+            }
+
+            IASTUtil.removePendingRequestId(fuzzRequest.id);
 
         } else {
             const config = parseAxiosHttpRequestToFuzz(fuzzRequest);
@@ -153,7 +154,6 @@ function handleFuzzRequest(fuzzDetails) {
 
 
             logger.info('Firing http request:: URL: ' + config.url);
-
             const response = restClient.fireRequest(config);
             handleFuzzResponse(response, fuzzDetails);
         }
@@ -210,6 +210,26 @@ function parseAxiosHttpRequestToFuzz(requestObject) {
     };
 }
 
+/**
+ * Parses the passed fuzz request object to
+ * Axios config.
+ *
+ * @param {JSON} requestObject
+ */
+function parseGRPCRequestToFuzz(requestObject) {
+    let serverName = requestObject.serverName ? requestObject.serverName : LOCALHOST;
+    let host = serverName + COLON + requestObject.serverPort
+    return {
+        url: requestObject.protocol + COLON_SLASH_SLASH + host + requestObject.url,
+        requestURI: requestObject.requestURI,
+        protocol: requestObject.protocol,
+        serverPort: requestObject.serverPort,
+        method: requestObject.method,
+        data: requestObject.body,
+        headers: requestObject.headers,
+        timeout: 5000,
+    };
+}
 
 
 /**

package/lib/nr-security-agent/lib/core/connections/websocket/response/startup-handshake-handler.js

@@ -18,7 +18,7 @@ module.exports.handler = function handler(json) {
       
         initLogger.info(LOG_MESSAGES.AGENT_INIT_WITH_PROP, JSON.stringify(startupConfig.config));
         initLogger.info('Security Agent is now ACTIVE for', applicationInfoModule.getInstance().applicationUUID);
-        const logMessage = new LogMessage.logMessage("SEVERE", `Security Agent is ACTIVE for ${ applicationInfoModule.getInstance().applicationUUID}`, __filename, null);
+        const logMessage = new LogMessage.logMessage("INFO", `Security Agent is ACTIVE for ${ applicationInfoModule.getInstance().applicationUUID}`, __filename, null);
         require('../../../commonUtils').addLogEventtoBuffer(logMessage);
 
     } catch (error) {

package/lib/nr-security-agent/lib/core/connections/websocket/websocket.js

@@ -104,6 +104,7 @@ SecWebSocket.prototype.init = function init() {
     const validatorService = commonUtils.getValidatorServiceEndpointURL();
     const authHeaders = require('../../Auth-headers').getInstance();
     initLogger.info(`Connecting to Validator at ${validatorService}`);
+    IASTUtil.IASTCleanup();
     let cert = ''
     try {
         const certPath = commonUtils.getPathOfCACert();
@@ -138,6 +139,7 @@ SecWebSocket.prototype.init = function init() {
     })
     webSocket.on('close', () => {
         logger.warn("WS connection closed");
+        this.obeyReconnect();
     })
     this.instance = webSocket;
 };
@@ -172,7 +174,7 @@ SecWebSocket.prototype.obeyReconnect = function obeyReconnect() {
     }
 
     initTimeOut = setTimeout(() => {
-        IASTUtil.IASTCleanup();
+
         logger.debug("Terminating ws instance and reconnecting");
         try {
             instance.terminate();
@@ -189,18 +191,21 @@ SecWebSocket.prototype.pingWS = async function pingWS() {
     let currentTime = Date.now();
 
     let timeDiffInPing = (currentTime - lastPongtime) / 1000;
-    if (timeDiffInPing > 40 && lastPongtime != 0) {
+    logger.debug("Websocket ready state is:",self.instance.readyState)
+    
+    if (timeDiffInPing > 40 && lastPongtime != 0 && self.instance.readyState > 1) {
         self.obeyReconnect();
         lastPongtime = 0;
         return;
     }
+
     try {
         await promisify(self.instance, self.instance.ping)(ACK, true, function (err) {
             if (err) {
                 logger.debug("Error while pinging:", err);
                 commonUtils.setWSHealthStatus('Error');
                 statusUtils.addErrortoBuffer(err);
-                self.obeyReconnect();
+    
             }
         });
     } catch (err) {
@@ -258,7 +263,7 @@ SecWebSocket.prototype.dispatch = async function dispatch(event) {
                 hc.getInstance().exitEventStats.sent++;
             }
 
-        });
+        })
     } catch (error) {
         logger.debug(LOG_MESSAGES.ERROR_WHILE_SEND_EVENT, eventStr, error);
         statusUtils.addErrortoBuffer(error);

package/lib/nr-security-agent/lib/core/event.js

@@ -34,6 +34,7 @@ function BasicInfo() {
     this.policyVersion = (!lodash.isEmpty(policyManager.getInstance().data)) ? policyManager.getInstance().data.version : 'DEFAULT';
 
     if (NRAgent && NRAgent.config) {
+        this.accountId = NRAgent.config.account_id;
         this.entityGuid = NRAgent.config.entity_guid;
         this.linkingMetadata = LinkingMetaData.getLinkingMetadata();
         this.linkingMetadata.agentRunId = NRAgent.config.run_id;

package/lib/nr-security-agent/lib/core/health-check.js

@@ -43,7 +43,6 @@ module.exports.getInstance = function () {
 function HC(info) {
     BasicInfo.call(this);
 
-
     this.applicationUUID = info.applicationUUID;
     this.eventType = 'sec_health_check_lc';
     if (NRAgent && NRAgent.config) {

package/lib/nr-security-agent/lib/core/sec-util.js

@@ -101,6 +101,7 @@ function generateSecEvent(securityMetadata) {
         const isAPIBlocked = false;
         const event = new SecEvent(traceObject.sourceDetails.fileName, traceObject.sourceDetails.funcName, traceObject.sourceDetails.lineNumber, securityMetadata.interceptedArgs, securityMetadata.executionId, agentModule.applicationInfo, securityMetadata.request, securityMetadata.eventType, traceObject.sourceDetails.source, securityMetadata.eventCategory, metaData, stakTrace, apiId, isAPIBlocked);
         event.metaData.isClientDetectedFromXFF = isClientDetectedFromXFF;
+        event.httpRequest.route = uri;
         return event;
     } catch (e) {
         statusUtils.addErrortoBuffer(e);

package/lib/nr-security-agent/lib/core/statusUtils.js

@@ -98,7 +98,7 @@ function writeSnapshot() {
         if (err) {
             logger.debug(err.message);
             const LogMessage = require('./LogMessage');
-            const logMessage = new LogMessage.logMessage("SEVERE", 'Error in creating snapshot file', __filename, err);
+            const logMessage = new LogMessage.logMessage("DEBUG", 'Error in creating snapshot file', __filename, err);
             commonUtils.addLogEventtoBuffer(logMessage);
         } else {
             logger.info('Snapshot updated to file: %s', statusFile);

package/lib/nr-security-agent/lib/core/websocket-client.js

@@ -75,6 +75,7 @@ const initialize = function () {
             let data  = require('./apiEndpoints').APIEndPoint(apiEndpoints);
             logger.debug("All API end points of the application is:",JSON.stringify(data));
             getDispatcherAndSendEvent(data);
+            require('../core/ExceptionReporting').startExceptionSendingSchedular();
         } catch (error) {
             logger.debug("Error while processing API endpoints",error);
         }
@@ -82,7 +83,7 @@ const initialize = function () {
         try {
             const framework = NRAgent.environment.get('Framework')[0];
             const dispatcher = NRAgent.environment.get('Dispatcher')[0];
-            const logMessage = new LogMessage.logMessage("SEVERE", `Detected framework: ${framework} and dispatcher: ${dispatcher}`, __filename, null);
+            const logMessage = new LogMessage.logMessage("INFO", `Detected framework: ${framework} and dispatcher: ${dispatcher}`, __filename, null);
             commonUtils.addLogEventtoBuffer(logMessage);
         } catch (error) {
             logger.debug("Error while extracting data from APM environment",error);

package/lib/nr-security-agent/lib/core/xss-utils.js

@@ -10,6 +10,7 @@ const querystring = require('querystring');
 const { Agent } = require('./agent');
 
 const htmlEntities = require('html-entities');
+const { STRING } = require('./sec-agent-constants');
 
 const tagNameRegex = /<([a-zA-Z_-]+[0-9]*|!--)/gmi;
 const attribRegex = /([^(/\s<'">)]+?)(?:\s*)=\s*(('|")([\s\S]*?)(?:(?=(\\?))\5.)*?\3|.+?(?=\/>|>|\?>|\s|<\/|$))/gmi;
@@ -136,10 +137,15 @@ function decodeResponseData (responseBody, responseHeaders) {
 
 function isXSS (combinedData) {
     const attackConstructs = new Set();
-    for (const data of combinedData) {
-        const constructs = getXSSConstructs(data);
-        constructs.forEach(attackConstructs.add, attackConstructs);
+    try {
+        for (const data of combinedData) {
+            const constructs = getXSSConstructs(data);
+            constructs.forEach(attackConstructs.add, attackConstructs);
+        }
+    } catch (error) {
+        logger.debug("Error while getting rxss constucts:", error);
     }
+    
     return attackConstructs;
 }
 
@@ -152,7 +158,7 @@ function getXSSConstructs (data) {
     let tmpStartPos = 0;
     let matcher;
     let attribMatcher;
-    while (currPos < data.length) {
+    while (currPos < data.length && typeof data == STRING ) {
         let tagName;
 
         matcher = tagNameRegex.exec(data);
@@ -233,7 +239,7 @@ function getXSSConstructs (data) {
             currPos = tmpCurrPos;
         }
 
-        if (data.charAt(currPos) !== ANGLE_END_CHAR) {
+        if (typeof data == STRING && data.charAt(currPos) !== ANGLE_END_CHAR) {
             const tmp = data.indexOf(ANGLE_END, currPos);
             if (tmp !== -1) {
                 currPos = tmp;

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@newrelic/security-agent",
-  "version": "1.2.0",
+  "version": "1.4.0",
   "description": "New Relic Security Agent for Node.js",
   "main": "index.js",
-  "jsonVersion": "1.2.0",
+  "jsonVersion": "1.2.3",
   "contributors": [
     {
       "name": "Sumit Suthar",
@@ -55,9 +55,10 @@
     "unescape": "^1.0.1",
     "unescape-js": "^1.1.4",
     "uuid": "^9.0.1",
-    "ws": "^8.14.2"
+    "ws": "^8.17.1"
   },
   "devDependencies": {
+    "@grpc/proto-loader": "^0.7.10",
     "@hapi/hapi": "^21.3.0",
     "@koa/router": "^12.0.0",
     "@newrelic/newrelic-oss-cli": "^0.1.2",