@newrelic/security-agent 2.1.1 → 2.2.0

package/CHANGELOG.md

@@ -1,3 +1,12 @@
+### v2.2.0 (2024-12-18)
+#### Features
+* Support for express 5.x 
+* IAST support for GraphQL
+* Added support for trustboundary security events
+
+#### Bug fixes
+* Fix for empty route in fastify
+
 ### v2.1.1 (2024-11-07)
 #### Bug fixes
 * Fix for assignment to logger constant 

package/lib/instrumentation-security/core/event-constants.js

@@ -14,14 +14,15 @@ const EVENT_TYPE = {
     HTTP_REQUEST: 'HTTP_REQUEST',
     CODE_INJECTION: 'CODE_INJECTION',
     XXE: 'XXE',
-    CIPHER: 'CIPHER',
     HASH: 'HASH',
     RANDOM: 'RANDOM',
     UNVALIDATED_REDIRECT: 'UNVALIDATED_REDIRECT',
     REFLECTED_XSS: 'REFLECTED_XSS',
     XPATH: 'XPATH',
     LDAP: 'LDAP',
-    SECURE_COOKIE: 'SECURE_COOKIE'
+    SECURE_COOKIE: 'SECURE_COOKIE',
+    TRUSTBOUNDARY: 'TRUSTBOUNDARY',
+    CRYPTO: 'CRYPTO',
 }
 const EVENT_CATEGORY = {
     MYSQL: 'MYSQL',
@@ -42,7 +43,9 @@ const EVENT_CATEGORY = {
     REFLECTED_XSS: 'REFLECTED_XSS',
     XPATH: 'XPATH',
     LDAP: 'LDAP',
-    SECURE_COOKIE: 'SECURE_COOKIE'
+    SECURE_COOKIE: 'SECURE_COOKIE',
+    TRUSTBOUNDARY: 'TRUSTBOUNDARY',
+    CIPHER: 'CIPHER',
 }
 
 module.exports = {

package/lib/instrumentation-security/hooks/crypto/nr-crypto.js

@@ -0,0 +1,124 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier:  New Relic Software License v1.0
+ */
+
+module.exports = initialize
+const requestManager = require('../../core/request-manager');
+const secUtils = require("../../core/sec-utils");
+const API = require("../../../nr-security-api");
+const securityMetaData = require('../../core/security-metadata');
+const { EVENT_TYPE, EVENT_CATEGORY } = require('../../core/event-constants');
+const { NR_CSEC_FUZZ_REQUEST_ID } = require('../../core/constants');
+const logger = API.getLogger();
+
+/**
+ * Entry point of ldapjs and ldapts module hook
+ * @param {*} shim 
+ * @param {*} mod 
+ * @param {*} moduleName 
+ */
+function initialize(shim, mod, moduleName) {
+    logger.info('Instrumenting ' + moduleName)
+    cryptoCipherHooks(shim, mod, 'createCipheriv', moduleName);
+    cryptoHashHmacHooks(shim, mod, 'createHash', moduleName);
+    cryptoHashHmacHooks(shim, mod, 'createHmac', moduleName);
+    // cryptoRandomHooks(shim, mod, 'randomInt', moduleName);
+    // cryptoRandomHooks(shim, mod, 'randomBytes', moduleName);
+    cryptoRandomHooks(shim, Math, 'random', "Math");
+}
+/**
+ * wrapper to hook crypto cipher methods
+ * @param {*} shim 
+ * @param {*} mod 
+ * @param {*} methodName 
+ * @param {*} moduleName 
+ */
+function cryptoCipherHooks(shim, mod, methodName, moduleName) {
+    shim.wrap(mod, methodName, function makeWrapper(shim, fn) {
+        logger.debug(`Instrumenting ${moduleName}.${methodName}`);
+        return function wrapper() {
+            const interceptedArgs = [arguments[0]];
+            shim.interceptedArgs = interceptedArgs;
+            const request = requestManager.getRequest(shim);
+            if (request) {
+                const traceObject = secUtils.getTraceObject(shim);
+                const secMetadata = securityMetaData.getSecurityMetaData(request, interceptedArgs, traceObject, secUtils.getExecutionId(), EVENT_TYPE.CRYPTO, EVENT_CATEGORY.CIPHER)
+                const secEvent = API.generateSecEvent(secMetadata);
+                this.secEvent = secEvent;
+                API.sendEvent(secEvent);
+            }
+            const result = fn.apply(this, arguments);
+
+            if (result && request && request.headers[NR_CSEC_FUZZ_REQUEST_ID]) {
+                API.generateExitEvent(this.secEvent);
+                delete this.secEvent
+            }
+            return result;
+        }
+    })
+}
+
+
+/**
+ * wrapper to hook crypto hash and mac methods
+ * @param {*} shim 
+ * @param {*} mod 
+ * @param {*} methodName 
+ * @param {*} moduleName 
+ */
+function cryptoHashHmacHooks(shim, mod, methodName, moduleName) {
+    shim.wrap(mod, methodName, function makeWrapper(shim, fn) {
+        logger.debug(`Instrumenting ${moduleName}.${methodName}`);
+        return function wrapper() {
+            const interceptedArgs = [arguments[0]];
+            shim.interceptedArgs = interceptedArgs;
+            const request = requestManager.getRequest(shim);
+            if (request) {
+                const traceObject = secUtils.getTraceObject(shim);
+                const secMetadata = securityMetaData.getSecurityMetaData(request, interceptedArgs, traceObject, secUtils.getExecutionId(), EVENT_TYPE.HASH, EVENT_CATEGORY.HASH)
+                const secEvent = API.generateSecEvent(secMetadata);
+                this.secEvent = secEvent;
+                API.sendEvent(secEvent);
+            }
+            const result = fn.apply(this, arguments);
+            if (result && request && request.headers[NR_CSEC_FUZZ_REQUEST_ID]) {
+                API.generateExitEvent(this.secEvent);
+                delete this.secEvent
+            }
+            return result;
+        }
+    })
+}
+/**
+ * Wrapper for random hooks
+ * @param {*} shim 
+ * @param {*} mod 
+ * @param {*} methodName 
+ * @param {*} moduleName 
+ */
+function cryptoRandomHooks(shim, mod, methodName, moduleName) {
+    shim.wrap(mod, methodName, function makeWrapper(shim, fn) {
+        logger.debug(`Instrumenting ${moduleName}.${methodName}`);
+        return function wrapper() {
+            const interceptedArgs = ["Math.random"];
+            shim.interceptedArgs = interceptedArgs;
+            const request = requestManager.getRequest(shim);
+            if (request && arguments[0]) {
+                const traceObject = secUtils.getTraceObject(shim);
+                const secMetadata = securityMetaData.getSecurityMetaData(request, interceptedArgs, traceObject, secUtils.getExecutionId(), EVENT_TYPE.RANDOM, EVENT_CATEGORY.WEAKRANDOM)
+                const secEvent = API.generateSecEvent(secMetadata);
+                this.secEvent = secEvent;
+                API.sendEvent(secEvent);
+            }
+            const result = fn.apply(this, arguments);
+            if (result && request && request.headers[NR_CSEC_FUZZ_REQUEST_ID]) {
+                API.generateExitEvent(this.secEvent);
+                delete this.secEvent
+            }
+            return result;
+        }
+    })
+}
+
+

package/lib/instrumentation-security/hooks/express/nr-express.js

@@ -30,12 +30,14 @@ module.exports = function initialize(shim, express) {
 
   if (express.Router.use) {
     wrapExpress4(shim, express)
-  } 
+  }
+  else if (express.Router.prototype) {
+    wrapExpress5(shim, express)
+  }
   if(API && API.getNRAgent() && !API.getNRAgent().config.security.exclude_from_iast_scan.iast_detection_category.invalid_file_access){
     expressFileHook(shim, express && express.response, 'download')
     expressFileHook(shim, express && express.response, 'sendFile')
   }
-  
 }
 
 /**
@@ -121,7 +123,7 @@ function extractParams(shim, req) {
  * @param {*} mod 
  * @param {*} fun 
  */
-function expressFileHook(shim, mod, fun){
+function expressFileHook(shim, mod, fun) {
   shim.wrap(mod, fun, function makeFAWrapper(shim, fn) {
     if (!shim.isFunction(fn)) {
       return fn
@@ -149,4 +151,70 @@ function expressFileHook(shim, mod, fun){
   });
 }
 
+/**
+ * Wrapper to hook express version 5.x route method
+ * @param {*} shim 
+ * @param {*} express 
+ */
+function wrapExpress5(shim, express) {
+  shim.wrap(express.Router.prototype, 'route', function wrapRoute(shim, fn) {
+    if (!shim.isFunction(fn)) {
+      return fn
+    }
+    logger.debug('Instrumenting express.Router.prototype.route');
+    return function wrappedRoute() {
+      try {
+        const stakTrace = secUtils.traceElementForRoute();
+        const splittedStack = stakTrace[0].split(DOUBLE_DOLLAR);
+        const key = lodash.upperCase(splittedStack[1]) + ATTHERATE + arguments[0];
+        routeManager.setRoute(key, splittedStack[0]);
+      } catch (error) {
+
+      }
+      const route = fn.apply(this, arguments)
+      return route;
+    }
+  })
+
+}
+
+module.exports.wrapRouter = function wrapExpress5Router(shim, mod) {
+  let layer = shim.require('./lib/layer');
+  shim.wrap(layer.prototype, 'match', function wrapParam(shim, fn) {
+    if (!shim.isFunction(fn)) {
+      return fn
+    }
+    logger.debug('Instrumenting router.layer.match');
+    return function wrappedParam() {
+      const route = fn.apply(this, arguments);
+
+      try {
+        const uri = this.route.path;
+        const params = this.params;
+        const transaction = shim.tracer.getTransaction();
+        if (transaction) {
+          let request = requestManager.getRequestFromId(transaction.id);
+          if (params && request) {
+            Object.keys(params).forEach(function (key) {
+              if (params[key]) {
+                if (!request.parameterMap[key]) {
+                  request.parameterMap[key] = new Array(params[key].toString());
+                  requestManager.setRequest(transaction.id, request);
+                }
+              }
+            });
+          }
+          if (uri && request) {
+            request.uri = uri;
+            requestManager.setRequest(transaction.id, request);
+          }
+        }
+      } catch (error) {
+        logger.debug("Error while getting path params via router module", error);
+      }
+
+      return route
+    }
+  })
+}
 

package/lib/instrumentation-security/hooks/fastify/nr-fastify.js

@@ -10,7 +10,6 @@ const { ATTHERATE, DOUBLE_DOLLAR } = require('../../core/constants');
 const lodash = require('lodash');
 const routeManager = require('../../core/route-manager');
 const semver = require('semver')
-const url = require('url');
 const API = require("../../../nr-security-api");
 const logger = API.getLogger();
 
@@ -119,12 +118,10 @@ function setupExports(original, wrappedExport) {
  */
 function extractParams(shim, req) {
   try {
-    const reqURL = req.url || req.raw.url;
-    const parsedURI = url.parse(reqURL).pathname;
     const transaction = shim.tracer.getTransaction();
     if (transaction) {
       let request = requestManager.getRequestFromId(transaction.id);
-      if (req.params && segment && request) {
+      if (req.params && request) {
         Object.keys(req.params).forEach(function (key) {
           if (req.params[key]) {
             if (!request.parameterMap[key]) {
@@ -144,9 +141,9 @@ function extractParams(shim, req) {
           }
         });
       }
-      let method = request.method.toUpperCase();
-      if (parsedURI && request && requestManager.requestMap[method + ATTHERATE + parsedURI]) {
-        request.uri = parsedURI;
+      const txInfo = lodash.get(req, Object.getOwnPropertySymbols(req).find(symbol => symbol.toString() === 'Symbol(fastify.context)'));
+      if (request && txInfo && txInfo.config && txInfo.config.url) {
+        request.uri = txInfo.config.url;
         requestManager.setRequest(transaction.id, request);
       }
     }

package/lib/instrumentation-security/hooks/graphql/nr-graphql.js

@@ -0,0 +1,75 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: New Relic Software License v1.0
+ */
+
+'use strict'
+
+/**
+ * Express middleware generates traces where middleware are considered siblings
+ * (ended on 'next' invocation) and not nested. Middlware are nested below the
+ * routers they are mounted to.
+ */
+
+const requestManager = require("../../core/request-manager");
+const { QUESTIONMARK } = require('../../core/constants');
+const API = require("../../../nr-security-api");
+const logger = API.getLogger();
+const { APPLICATION_JSON } = require('../../core/constants');
+let querystring = require('querystring');
+
+
+module.exports = function initialize(shim, mod) {
+  logger.info("Instrumenting graphql");
+
+  shim.wrap(mod, 'execute', function wrapExecute(shim, fn) {
+    if (!shim.isFunction(fn)) {
+      return fn;
+    }
+    return function wrappedExecute() {
+      const segment = shim.getActiveSegment();
+      try {
+        if (segment && segment.transaction) {
+          let request = requestManager.getRequestFromId(segment.transaction.id);
+          let customDataType = {};
+          //check for query parms
+          if (request.headers['x-apollo-operation-name']) {
+            const queryString = request.url.split(QUESTIONMARK)[1];
+            const parsedQueryString = querystring.parse(queryString);
+            let allValues = Object.values(parsedQueryString);
+            for (let index = 0; index < allValues.length; index++) {
+              const element = allValues[index];
+              if (element.startsWith('query')) {
+                customDataType['*.query'] = 'GRAPHQL_QUERY';
+              }
+              if (element.startsWith('variables')) {
+                customDataType['*.variables'] = 'GRAPHQL_VARIABLE';
+              }
+            }
+            request.customDataType = customDataType;
+            requestManager.setRequest(segment.transaction.id, request);
+          }
+
+          //check for body
+          if (request.headers['content-type'] === APPLICATION_JSON) {
+            const requestBody = JSON.parse(request.body);
+            if (requestBody.query) {
+              customDataType['*.query'] = 'GRAPHQL_QUERY';
+            }
+            if (requestBody.variables) {
+              customDataType['*.variables'] = 'GRAPHQL_VARIABLE';
+            }
+            request.customDataType = customDataType;
+            requestManager.setRequest(segment.transaction.id, request);
+          }
+        }
+
+      } catch (error) {
+        logger.debug("Error while processing graphql http request", error);
+      }
+
+      return fn.apply(this, arguments);
+    }
+  })
+}
+

package/lib/instrumentation-security/hooks/http/nr-http.js

@@ -5,7 +5,7 @@
 
 module.exports = initialize
 const requestManager = require('../../core/request-manager');
-const { NR_CSEC_FUZZ_REQUEST_ID, QUESTION_MARK, EMPTY_STRING, UTF8, CONTENT_TYPE, TEXT_HTML, APPLICATION_JSON, APPLICATION_XML, APPLICATION_XHTML, TEXT_PLAIN, APPLICATION_X_FORM_URLENCODED, MULTIPART_FORM_DATA, COMMA, SEMI_COLON, EQUAL, SECURE, HTTPONLY, SAMESITE, STRICT } = require('../../core/constants');
+const { NR_CSEC_FUZZ_REQUEST_ID, QUESTION_MARK, EMPTY_STRING, UTF8, CONTENT_TYPE, TEXT_HTML, APPLICATION_JSON, APPLICATION_XML, APPLICATION_XHTML, TEXT_PLAIN, APPLICATION_X_FORM_URLENCODED, MULTIPART_FORM_DATA, COMMA, SEMI_COLON, EQUAL, SECURE, HTTPONLY, SAMESITE, STRICT, OBJECT } = require('../../core/constants');
 const ARRAY_TYPE = 'Array';
 const STRING_TYPE = 'string';
 const BUFFER_TYPE = 'Buffer';
@@ -446,6 +446,9 @@ function responseHook(resp, req, shim) {
       }
       try {
         secureCookieCheck(response, shim);
+        if (response && response.req && response.req.session) {
+          trustBoundaryCheck(response.req.session, shim)
+        }
       } catch (error) {
         logger.debug("Error while generating secure cookie event");
       }
@@ -730,3 +733,32 @@ function truncateStringToBytes(inputString, maxBytes) {
   return truncatedString;
 }
 
+/**
+ * Utility to generate trustboundary events.
+ * @param {*} sessionObject 
+ * @param {*} shim 
+ */
+function trustBoundaryCheck(sessionObject, shim) {
+  try {
+    const request = requestManager.getRequest(shim);
+    let params = [];
+    Object.keys(sessionObject).forEach(key => {
+      if (sessionObject[key] && typeof sessionObject[key] != OBJECT) {
+        params.push(String(key));
+        params.push(String(sessionObject[key]));
+      }
+    });
+    if (!lodash.isEmpty(params)) {
+      const traceObject = secUtils.getTraceObject(shim);
+      const secMetadata = securityMetaData.getSecurityMetaData(request, params, traceObject, secUtils.getExecutionId(), EVENT_TYPE.TRUSTBOUNDARY, EVENT_CATEGORY.TRUSTBOUNDARY)
+      const secEvent = API.generateSecEvent(secMetadata);
+      API.sendEvent(secEvent);
+    }
+
+  } catch (error) {
+    logger.debug("Error while processing trustboundary", error);
+
+  }
+
+}
+

package/lib/instrumentation-security/index.js

@@ -235,3 +235,22 @@ newrelic.instrument({
   }
 })
 
+newrelic.instrument({
+  moduleName: 'graphql/execution/execute',
+  isEsm: true,
+  onRequire: require('./hooks/graphql/nr-graphql'),
+  onError: function intrumentErrorHandler(err) {
+    logger.error(err.message, err.stack)
+  }
+})
+
+newrelic.instrument({
+  moduleName: 'router',
+  isEsm: true,
+  onRequire: require('./hooks/express/nr-express').wrapRouter,
+  onError: function intrumentErrorHandler(err) {
+    logger.error(err.message, err.stack)
+  }
+})
+
+

package/lib/nr-security-agent/lib/core/sec-util.js

@@ -29,6 +29,10 @@ const initLogger = logs.getInitLogger();
 
 const NODE_SER = 'node-serialize/lib/serialize.js';
 const SECURE_COOKIE = 'SECURE_COOKIE';
+const TRUSTBOUNDARY = 'TRUSTBOUNDARY';
+const HASH = "HASH";
+const CRYPTO = "CRYPTO";
+const RANDOM = "RANDOM";
 
 const insecureSettingApiIdSet = new Set();
 
@@ -110,7 +114,7 @@ function generateSecEvent(securityMetadata) {
 
         let apiId = shaUtil.getSHA256ForData(traceObject.stacktrace.join('|') + uri);
         apiId = securityMetadata.eventType + HYPHEN + apiId;
-        if (securityMetadata.eventType == SECURE_COOKIE) {
+        if (securityMetadata.eventType == SECURE_COOKIE || securityMetadata.eventType == CRYPTO || securityMetadata.eventType == HASH || securityMetadata.eventType == RANDOM) {
             if (insecureSettingApiIdSet.has(apiId)) {
                 return;
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@newrelic/security-agent",
-  "version": "2.1.1",
+  "version": "2.2.0",
   "description": "New Relic Security Agent for Node.js",
   "main": "index.js",
   "jsonVersion": "1.2.9",