@newrelic/security-agent 1.3.0 → 1.5.0

package/CHANGELOG.md

@@ -1,3 +1,27 @@
+### v1.5.0 (2024-08-14)
+#### Features
+* Support for Node.js v22.x
+#### Bug fixes
+* Fix for traceId in error reporting
+#### Miscellaneous chores
+* (deps): bumped axios from 1.6.8 to 1.7.4 
+* (deps-dev): bumped ws from 7.5.9 to 8.18.0
+#### Continuous integration
+* Added Node.js v22.x to unit tests
+
+### v1.4.0 (2024-06-24)
+#### Features
+* Added support to report application's errors while IAST scanning
+* Support to detect gRPC API endpoints 
+#### Bug fixes
+* Remove additional headers added by IAST client
+* Fix for uncaught exception reporting 
+#### Miscellaneous chores
+* Updated package.json to bump ws from 8.14.2 to 8.17.1 
+* (deps-dev): bump @grpc/grpc-js from 1.9.12 to 1.10.9 
+* (deps-dev): bump braces from 3.0.2 to 3.0.3
+* (deps): bump ws from 8.14.2 to 8.17.1 
+
 ### v1.3.0 (2024-05-31)
 #### Features
 * Added route field in security event for API endpoint mapping

package/THIRD_PARTY_NOTICES.md

@@ -77,7 +77,7 @@ code, the source code can be found at [https://github.com/newrelic/csec-node-age
 
 ### axios
 
-This product includes source derived from [axios](https://github.com/axios/axios) ([v1.6.8](https://github.com/axios/axios/tree/v1.6.8)), distributed under the [MIT License](https://github.com/axios/axios/blob/v1.6.8/LICENSE):
+This product includes source derived from [axios](https://github.com/axios/axios) ([v1.7.4](https://github.com/axios/axios/tree/v1.7.4)), distributed under the [MIT License](https://github.com/axios/axios/blob/v1.7.4/LICENSE):
 
 ```
 # Copyright (c) 2014-present Matt Zabriskie & Collaborators
@@ -588,7 +588,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 ### ws
 
-This product includes source derived from [ws](https://github.com/websockets/ws) ([v8.14.2](https://github.com/websockets/ws/tree/v8.14.2)), distributed under the [MIT License](https://github.com/websockets/ws/blob/v8.14.2/LICENSE):
+This product includes source derived from [ws](https://github.com/websockets/ws) ([v8.17.1](https://github.com/websockets/ws/tree/v8.17.1)), distributed under the [MIT License](https://github.com/websockets/ws/blob/v8.17.1/LICENSE):
 
 ```
 Copyright (c) 2011 Einar Otto Stangvik <einaros@gmail.com>
@@ -619,7 +619,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ### @grpc/proto-loader
 
-This product includes source derived from [@grpc/proto-loader](https://github.com/grpc/grpc-node) ([v0.7.7](https://github.com/grpc/grpc-node/tree/v0.7.7)), distributed under the [Apache-2.0 License](https://github.com/grpc/grpc-node/blob/v0.7.7/LICENSE):
+This product includes source derived from [@grpc/proto-loader](https://github.com/grpc/grpc-node) ([v0.7.13](https://github.com/grpc/grpc-node/tree/v0.7.13)), distributed under the [Apache-2.0 License](https://github.com/grpc/grpc-node/blob/v0.7.13/LICENSE):
 
 ```
                                  Apache License

package/lib/instrumentation-security/core/constants.js

@@ -62,5 +62,6 @@ module.exports = {
     UNDEFINED: 'undefined',
     SELF_FD_PATH: '/proc/self/fd/',
     NR_CSEC_FUZZ_REQUEST_ID: 'nr-csec-fuzz-request-id',
+    ASTERISK: "*"
 
 };

package/lib/instrumentation-security/hooks/grpc-js/nr-grpc.js

@@ -9,11 +9,15 @@ const secUtils = require("../../core/sec-utils");
 const API = require("../../../nr-security-api");
 const securityMetaData = require('../../core/security-metadata');
 const { EVENT_TYPE, EVENT_CATEGORY } = require('../../core/event-constants');
-const { NR_CSEC_FUZZ_REQUEST_ID } = require('../../core/constants');
+const { NR_CSEC_FUZZ_REQUEST_ID, DOUBLE_DOLLAR, ATTHERATE, ASTERISK } = require('../../core/constants');
 const logger = API.getLogger();
 const semver = require('semver');
 const grpcutils = require('../../core/grpc-utils');
+const routeManager = require('../../core/route-manager');
 let serverAddress;
+const ExceptionReporting = require('../../../nr-security-agent/lib/core/ExceptionReporting');
+
+
 
 module.exports.initialize = function initialize(shim, grpc, moduleName) {
   logger.info('Instrumenting grpc', moduleName);
@@ -118,17 +122,39 @@ function wrapStart(shim, original) {
 }
 
 
-
+/**
+ * Wrapper for addService method
+ * @param {*} shim 
+ * @param {*} original 
+ * @returns 
+ */
 function wrapAddService(shim, original) {
   if (!shim.isFunction(original)) {
     return original
   }
   return function wrappedbindAsync() {
+    try {
+      const stakTrace = secUtils.traceElementForRoute();
+      const splittedStack = stakTrace[0].split(DOUBLE_DOLLAR);
+      let serviceValues = Object.values(arguments[0]);
+      for (const [key, value] of Object.entries(serviceValues)) {
+        const routeKey = ASTERISK + ATTHERATE + value.path;
+        let finalHandler = value.originalName + ATTHERATE + splittedStack[0];
+        routeManager.setRoute(routeKey, finalHandler);
+      }
+    } catch (error) {
+    }
     const result = original.apply(this, arguments);
     return result;
   }
 }
 
+/**
+ * wrapper for loadPackageDefinition method
+ * @param {*} shim 
+ * @param {*} original 
+ * @returns 
+ */
 function wrapLoadPackageDefinition(shim, original) {
   if (!shim.isFunction(original)) {
     return original
@@ -224,6 +250,21 @@ function wrapCallback(shim, mod, method) {
     }
     return function wrappedCallback() {
       const response = arguments[1];
+      try {
+        const request = requestManager.getRequest(shim);
+        if (arguments[0]) {
+          if (arguments[0].details && request) {
+            ExceptionReporting.generateExceptionReportingEvent(arguments[0].details, request);
+          }
+          //TODO GRPC response errors reporting 
+          // if (arguments[0].code && arguments[0].code > 0 && request) {
+          //   let responseCode = arguments[0].code
+          //   ExceptionReporting.generate5xxReportingEvent(null, request, responseCode);
+          // }
+        }
+      } catch (error) {
+
+      }
       const result = fn.apply(this, arguments);
       return result;
 
@@ -254,7 +295,7 @@ function addRequestData(shim, type, path, args) {
       }
       data.type = type;
       data.protocol = 'grpc';
-      data.isGRPC = true;
+      data.isGrpc = true;
       data.body = JSON.stringify(args.request);
       data.serverPort = shim.serverPort;
       const transactionId = segment.transaction.id;

package/lib/instrumentation-security/hooks/http/nr-http.js

@@ -31,13 +31,16 @@ const isInvalid = require('is-invalid-path');
 const path = require('path');
 const fs = require('fs');
 const semver = require('semver');
-
+const ExceptionReporting = require('../../../nr-security-agent/lib/core/ExceptionReporting');
 
 const CSEC_SEP = ':IAST:';
 const find = '{{NR_CSEC_VALIDATOR_HOME_TMP}}';
 const CSEC_HOME_TMP_CONST = new RegExp(find, 'g');
 let CSEC_HOME = NRAgent && NRAgent.config.newrelic_home ? NRAgent.config.newrelic_home : NRAgent && NRAgent.config.logging.filepath ? path.dirname(NRAgent.config.logging.filepath) : require('path').join(process.cwd());
 const CSEC_HOME_TMP = `${CSEC_HOME}/nr-security-home/tmp/language-agent/${process.env.applicationUUID}`
+let lastTransactionId = EMPTY_STRING;
+let uncaughtExceptionReportFlag = false;
+
 
 /**
  * Entry point of http module hook
@@ -178,7 +181,7 @@ function parseFuzzheaders(requestData, transactionId) {
         if (verifiedHash) {
           logger.debug("Encrypted Data:", encryptedData);
           logger.debug("Decrypted Data:", decryptedData)
-          logger.debug("fliesTocreate:",filesToCreate);
+          logger.debug("fliesTocreate:", filesToCreate);
           for (let i = 0; i < filesToCreate.length; i++) {
             let file = filesToCreate[i].trim();
             file = file.replace(CSEC_HOME_TMP_CONST, CSEC_HOME_TMP);
@@ -192,11 +195,11 @@ function parseFuzzheaders(requestData, transactionId) {
                   logger.debug(parentDir + ' Already Exists');
                 }
                 fs.closeSync(fs.openSync(file, 'w'));
-  
+
                 requestData.tempFiles = [];
                 requestData.tempFiles.push(file);
                 requestManager.setRequest(transactionId, requestData);
-  
+
               } catch (error) {
                 logger.debug(error);
               }
@@ -243,6 +246,7 @@ function addRequestData(shim, request) {
       data.clientIP = requestIp.getClientIp(request);
       const transactionId = segment.transaction.id;
       const storedRequest = requestManager.getRequestFromId(transactionId);
+      lastTransactionId = transactionId;
       if (storedRequest && storedRequest.uri) {
         data.uri = storedRequest.uri;
         data.parameterMap = storedRequest.parameterMap;
@@ -396,8 +400,27 @@ function responseHook(resp, req, shim) {
     }
     return function wrappedEnd() {
       const response = this;
-      responseBodyCompute(response, arguments);
       const request = requestManager.getRequest(shim);
+      const txInfo = lodash.get(response, Object.getOwnPropertySymbols(response).find(symbol => symbol.toString() === 'Symbol(transactionInfo)'));
+      try {
+        if (txInfo && txInfo.error && request) {
+          ExceptionReporting.generateExceptionReportingEvent(txInfo.error, request);
+        }
+        const responseCode = response.statusCode;
+        if (responseCode && parseInt(responseCode / 100) == 5 && request) {
+          if (txInfo && txInfo.error) {
+            ExceptionReporting.generate5xxReportingEvent(txInfo.error, request, responseCode);
+          }
+          else {
+            ExceptionReporting.generate5xxReportingEvent(null, request, responseCode);
+          }
+        }
+      } catch (error) {
+        logger.debug("Error while reporting error", error);
+      }
+
+      responseBodyCompute(response, arguments);
+
       const construct = API.checkForReflectedXSS(request, response.res.body, response.getHeaders());
       const policy = API.getPolicy();
       const dynamicScanningFlag = policy.data ? (policy.data.vulnerabilityScan?.enabled && policy.data.vulnerabilityScan.iastScan.enabled) : false;
@@ -565,4 +588,21 @@ function deleteTempFileForIAST(file) {
   } catch (error) {
     logger.debug("Unable to delete temporary file", error);
   }
-}
+}
+/**
+ * Collect and report the uncaught Exception
+ */
+process.on('uncaughtException', (err, origin) => {
+  console.error(err);
+  if(uncaughtExceptionReportFlag){
+    process.exit(1);
+  }
+  const request = requestManager.getRequestFromId(lastTransactionId);
+  const exception = new ExceptionReporting.exceptionReporting(err, request);
+  if (exception) {
+    API.sendEvent(exception);
+  }
+  logger.error("An uncaughtException is detected:", err);
+  uncaughtExceptionReportFlag = true;
+});
+

package/lib/nr-security-agent/lib/core/ExceptionReporting.js

@@ -0,0 +1,186 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: New Relic Software License v1.0
+ */
+
+const LinkingMetaData = require('./LinkingMetadata');
+const API = require('../../../nr-security-api');
+const NRAgent = API.getNRAgent();
+const { BasicInfo } = require('./event');
+const applicationInfo = require('./applicationinfo').getInstance();
+const exceptionsMap = new Map();
+const logs = require('./logging');
+const logger = logs.getLogger();
+const exceptionReportingInterval = 30000;
+const http = require('http');
+const shaUtil = require('./sha-size-util');
+
+const NR_LIB = '/newrelic/lib';
+
+const GRPCStatusMap = {
+    0: 'OK',
+    1: 'CANCELLED',
+    2: 'UNKNOWN',
+    3: 'INVALID_ARGUMENT',
+    4: 'DEADLINE_EXCEEDED',
+    5: 'NOT_FOUND',
+    6: 'ALREADY_EXISTS',
+    7: 'PERMISSION_DENIED',
+    8: 'RESOURCE_EXHAUSTED',
+    9: 'FAILED_PRECONDITION',
+    10: 'ABORTED',
+    11: 'OUT_OF_RANGE',
+    12: 'UNIMPLEMENTED',
+    13: 'INTERNAL',
+    14: 'UNAVAILABLE',
+    15: 'DATA_LOSS',
+    16: 'UNAUTHENTICATED',
+}
+
+/**
+ * constructor function to create createException object
+ * @param {*} message
+ * @param {*} cause
+ * @param {*} stacktrace
+ */
+function createException(exception) {
+    let exceptionObject = {};
+    try {
+        exceptionObject.message = exception.message ? exception.message : '';
+        exceptionObject.cause = null;
+        exceptionObject.type = exception.name ? exception.name : 'Error';
+        if (exception.stack) {
+            let stacktraceInList = exception.stack.split('\n');
+            stacktraceInList = stacktraceInList.slice(1);
+            let fileteredStackTrace = [];
+            for (const str of stacktraceInList) {
+                if (!str.includes(NR_LIB) && str.length > 0) {
+                    fileteredStackTrace.push(str.trim());
+                }
+            }
+            exceptionObject.stackTrace = fileteredStackTrace;
+        }
+
+    } catch (error) {
+    }
+
+    return exceptionObject;
+}
+
+/**
+  * constructor function to create exceptionReporting object;
+  * @param {*} timestamp
+  * @param {*} level
+  * @param {*} message
+  * @param {*} caller
+  * @param {*} exception
+  * @param {*} linkingMetadata
+  */
+function exceptionReporting(exception, request, responseCode) {
+    try {
+        BasicInfo.call(this);
+        this.jsonVersion = applicationInfo.jsonVersion;
+        this.pid = applicationInfo.pid ? applicationInfo.pid : null;
+        this.jsonName = 'application-runtime-error';
+        this.applicationUUID = applicationInfo.applicationUUID;
+        this.policyVersion = applicationInfo.policyVersion;
+        this.collectorVersion = applicationInfo.collectorVersion ? applicationInfo.collectorVersion : null;
+        this.buildNumber = applicationInfo.buildNumber ? applicationInfo.buildNumber : null;
+        this.timestamp = Date.now();
+        this.httpRequest = request;
+        this.httpRequest.route = request.uri ? request.uri : request.url;
+        this.exception = null;
+        this.counter = 1;
+        this.responseCode = responseCode ? responseCode : null
+
+        if (exception) {
+            this.exception = createException(exception);
+            this.category = exception.name;
+            this.traceId = shaUtil.getSHA256ForData(this.exception.stackTrace.join('|') + this.category + this.httpRequest.route + this.httpRequest.method);
+        }
+        
+        if (responseCode) {
+            if (responseCode >= 500) {
+                this.category = http.STATUS_CODES[responseCode];
+                this.traceId = shaUtil.getSHA256ForData(this.category + this.httpRequest.route + this.httpRequest.method);
+            }
+            else {
+                this.category = GRPCStatusMap[responseCode];
+                this.traceId = shaUtil.getSHA256ForData(this.category + this.httpRequest.route + this.httpRequest.method);
+            }
+        }
+
+        if (NRAgent) {
+            this.linkingMetadata = LinkingMetaData.getLinkingMetadata();
+        }
+    } catch (error) {
+        logger.debug("Error while generating exceptionReporing", error);
+    }
+
+}
+
+function generateExceptionReportingEvent(error, request) {
+    try {
+        const exception = new exceptionReporting(error, request);
+        if(!exception.traceId){
+            return;
+        }
+        let key = exception.exception.type + exception.exception.stackTrace[0];
+        if (!exceptionsMap.has(key)) {
+            exceptionsMap.set(key, exception);
+        }
+        else {
+            let previousCounter = exceptionsMap.get(key).counter;
+            exception.counter = previousCounter ? previousCounter + 1: exception.counter + 1;
+            exceptionsMap.set(key, exception);
+        }
+    } catch (err) {
+        logger.debug("Error while generating application-runtime-error:", err);
+    }
+}
+
+function generate5xxReportingEvent(error, request, responseCode) {
+    try {
+        const exception = new exceptionReporting(error, request, responseCode);
+        if(!exception.traceId){
+            return;
+        }
+        let key = (request.uri ? request.uri : request.url) + responseCode;
+        if (!exceptionsMap.has(key)) {
+            exceptionsMap.set(key, exception);
+        }
+        else {
+            let previousCounter = exceptionsMap.get(key).counter;
+            exception.counter = previousCounter ? previousCounter + 1: exception.counter + 1;
+            exceptionsMap.set(key, exception);
+        }
+    } catch (err) {
+        logger.debug("Error while generating 5xx application-runtime-error:", err);
+    }
+}
+
+
+
+function startExceptionSendingSchedular() {
+    try {
+        setInterval(() => {
+            const values = Array.from(exceptionsMap.values());
+            for (let i = 0; i < values.length; i++) {
+                API.sendEvent(values[i]);
+            }
+            exceptionsMap.clear();
+        }, exceptionReportingInterval);
+    } catch (error) {
+        logger.info("Error in exception reporting schedular");
+    }
+    logger.info("Exception reporting schedular started");
+}
+
+
+module.exports = {
+    exceptionReporting,
+    createException,
+    generateExceptionReportingEvent,
+    generate5xxReportingEvent,
+    startExceptionSendingSchedular
+};

package/lib/nr-security-agent/lib/core/LogMessage.js

@@ -20,10 +20,11 @@ function logMessageException(exception) {
     try {
         exceptionObject.message = exception.message ? exception.message : '';
         exceptionObject.cause = null;
+        exceptionObject.type = exception.name;
         if (exception.stack) {
             let stacktraceInList = exception.stack.split('\n');
             stacktraceInList = stacktraceInList.slice(1);
-            exceptionObject.stacktrace = stacktraceInList;
+            exceptionObject.stackTrace = stacktraceInList;
         }
 
     } catch (error) {
@@ -51,6 +52,8 @@ function logMessage(level, message, caller, exception) {
         this.applicationUUID = applicationInfo.applicationUUID;
         this.groupName = applicationInfo.groupName;
         this.policyVersion = applicationInfo.policyVersion;
+        this.collectorVersion = applicationInfo.collectorVersion ? applicationInfo.collectorVersion : null;
+        this.buildNumber = applicationInfo.buildNumber ? applicationInfo.buildNumber : null;
         this.timestamp = Date.now();
         this.level = level ? level : 'SEVERE';
         this.message = message;

package/lib/nr-security-agent/lib/core/connections/restclient.js

@@ -12,6 +12,12 @@ const axios = require('axios').default;
  */
 function fireRequest (config) {
     axios.defaults.timeout = 5000;
+    axios.defaults.headers.common['user-agent'] = null;
+    axios.defaults.headers.common['accept-encoding'] = null;
+    axios.defaults.headers.common['connection'] = null;
+    axios.defaults.headers.common['sec-ch-ua-platform'] = null;
+    axios.defaults.headers.common['accept'] = null;
+    axios.defaults.headers.common['content-type'] = null;
     return axios(config);
 }
 

package/lib/nr-security-agent/lib/core/event.js

@@ -34,6 +34,7 @@ function BasicInfo() {
     this.policyVersion = (!lodash.isEmpty(policyManager.getInstance().data)) ? policyManager.getInstance().data.version : 'DEFAULT';
 
     if (NRAgent && NRAgent.config) {
+        this.accountId = NRAgent.config.account_id;
         this.entityGuid = NRAgent.config.entity_guid;
         this.linkingMetadata = LinkingMetaData.getLinkingMetadata();
         this.linkingMetadata.agentRunId = NRAgent.config.run_id;

package/lib/nr-security-agent/lib/core/health-check.js

@@ -43,7 +43,6 @@ module.exports.getInstance = function () {
 function HC(info) {
     BasicInfo.call(this);
 
-
     this.applicationUUID = info.applicationUUID;
     this.eventType = 'sec_health_check_lc';
     if (NRAgent && NRAgent.config) {

package/lib/nr-security-agent/lib/core/websocket-client.js

@@ -75,6 +75,7 @@ const initialize = function () {
             let data  = require('./apiEndpoints').APIEndPoint(apiEndpoints);
             logger.debug("All API end points of the application is:",JSON.stringify(data));
             getDispatcherAndSendEvent(data);
+            require('../core/ExceptionReporting').startExceptionSendingSchedular();
         } catch (error) {
             logger.debug("Error while processing API endpoints",error);
         }

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@newrelic/security-agent",
-  "version": "1.3.0",
+  "version": "1.5.0",
   "description": "New Relic Security Agent for Node.js",
   "main": "index.js",
-  "jsonVersion": "1.2.0",
+  "jsonVersion": "1.2.3",
   "contributors": [
     {
       "name": "Sumit Suthar",
@@ -35,7 +35,7 @@
     "url": "https://github.com/newrelic/csec-node-agent.git"
   },
   "dependencies": {
-    "axios": "^1.6.8",
+    "axios": "^1.7.4",
     "check-disk-space": "^3.4.0",
     "content-type": "^1.0.5",
     "fast-safe-stringify": "^2.1.1",
@@ -55,7 +55,7 @@
     "unescape": "^1.0.1",
     "unescape-js": "^1.1.4",
     "uuid": "^9.0.1",
-    "ws": "^8.14.2"
+    "ws": "^8.17.1"
   },
   "devDependencies": {
     "@grpc/proto-loader": "^0.7.10",