@newrelic/security-agent 2.3.1 → 2.4.0

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+### v2.4.0 (2025-03-21)
+#### Features
+* Support for gRPC error reporting
+* Support to detect API endpoints in next.js framework 
+#### Miscellaneous chores
+* Updated axios to v1.8.4
+
+### v2.3.2 (2025-03-11)
+#### Bug fixes
+* Updated axios to v1.8.2 
+#### Miscellaneous chores
+* Updated readme 
+
+
 ### v2.3.1 (2025-02-04)
 #### Bug fixes
 * Removed docker-cli-js dependency and updated mongodb unit test case (#283)

package/README.md

@@ -51,6 +51,7 @@ The [Developer docs](http://newrelic.github.io/node-newrelic/) for writing instr
     - `https`
     - `fs`
     - `child_process`
+    - `vm`
 - [mysql](https://www.npmjs.com/package/mysql)(2.16.x and above)
 - [mysql2](https://www.npmjs.com/package/mysql2) (2.x and above)
 - [pg](https://www.npmjs.com/package/pg)(7.x and above)
@@ -68,6 +69,7 @@ The [Developer docs](http://newrelic.github.io/node-newrelic/) for writing instr
 - [xpath](https://www.npmjs.com/package/xpath)(0.0.20 and above)
 - [xpath.js](https://www.npmjs.com/package/xpath.js)(0.0.1 and above) 
 - [undici](https://www.npmjs.com/package/undici)(4.7.0 and above) 
+- [next](https://www.npmjs.com/package/next)(13.4.19 and above) 
 
 For more information, please see New Relic Node.js agent [compatibility and requirements](https://docs.newrelic.com/docs/apm/agents/nodejs-agent/getting-started/compatibility-requirements-nodejs-agent/).
 

package/THIRD_PARTY_NOTICES.md

@@ -78,7 +78,7 @@ code, the source code can be found at [https://github.com/newrelic/csec-node-age
 
 ### axios
 
-This product includes source derived from [axios](https://github.com/axios/axios) ([v1.7.9](https://github.com/axios/axios/tree/v1.7.9)), distributed under the [MIT License](https://github.com/axios/axios/blob/v1.7.9/LICENSE):
+This product includes source derived from [axios](https://github.com/axios/axios) ([v1.8.4](https://github.com/axios/axios/tree/v1.8.4)), distributed under the [MIT License](https://github.com/axios/axios/blob/v1.8.4/LICENSE):
 
 ```
 # Copyright (c) 2014-present Matt Zabriskie & Collaborators

package/lib/instrumentation-security/hooks/grpc-js/nr-grpc.js

@@ -16,6 +16,7 @@ const grpcutils = require('../../core/grpc-utils');
 const routeManager = require('../../core/route-manager');
 let serverAddress;
 const ExceptionReporting = require('../../../nr-security-agent/lib/core/ExceptionReporting');
+const responseErrorSet = new Set([2, 12, 13, 14, 15])
 
 
 
@@ -58,6 +59,33 @@ module.exports.wrapStartCall = function wrappedClient(shim, callStream) {
   shim.wrap(callStream.Http2CallStream.prototype, 'start', wrapStart)
 }
 
+/**
+ * Wrapper for error collection
+ * @param {*} shim 
+ * @param {*} call 
+ */
+module.exports.wrapCall = function wrappedCall(shim, call) {
+  shim.wrap(call, 'callErrorFromStatus', function wrapCallErrorFromStatus(shim, fn) {
+    if (!shim.isFunction(fn)) {
+      return fn
+    }
+    return function wrappedCallErrorFromStatus() {
+      const errRes = fn.apply(this, arguments);
+      try {
+        let error = new Error(errRes.message);
+        error.stack = errRes.stack;
+        const request = requestManager.getRequest(shim);
+        if (request) {
+          ExceptionReporting.generate5xxReportingEvent(error, request);
+        }
+      } catch (error) {
+      }
+
+      return errRes;
+    }
+  })
+}
+
 module.exports.wrapServer = function wrappedServer(shim, server) {
   const grpcVersion = shim.require('./package.json').version
   logger.info("Instrumenting @grpc/grpc-js", grpcVersion)
@@ -109,6 +137,7 @@ function wrapStart(shim, original) {
       "path": method,
       "protocol": protocol,
     }
+
     if (request) {
       const traceObject = secUtils.getTraceObject(shim);
       const secMetadata = securityMetaData.getSecurityMetaData(request, urlObj, traceObject, secUtils.getExecutionId(), EVENT_TYPE.HTTP_REQUEST, EVENT_CATEGORY.HTTP)
@@ -256,11 +285,11 @@ function wrapCallback(shim, mod, method) {
           if (arguments[0].details && request) {
             ExceptionReporting.generateExceptionReportingEvent(arguments[0].details, request);
           }
-          //TODO GRPC response errors reporting 
-          // if (arguments[0].code && arguments[0].code > 0 && request) {
-          //   let responseCode = arguments[0].code
-          //   ExceptionReporting.generate5xxReportingEvent(null, request, responseCode);
-          // }
+
+          if (arguments[0].code && responseErrorSet.has(arguments[0].code) && request) {
+            let responseCode = arguments[0].code
+            ExceptionReporting.generate5xxReportingEvent(null, request, responseCode);
+          }
         }
       } catch (error) {
 
@@ -282,7 +311,7 @@ function wrapCallback(shim, mod, method) {
 function addRequestData(shim, type, path, args) {
   const data = Object.assign({});
   try {
-    const transaction = shim.tracer.getTransaction(); 
+    const transaction = shim.tracer.getTransaction();
     if (transaction) {
       data.method = path;
       data.url = path;

package/lib/instrumentation-security/hooks/nextjs/nr-next.js

@@ -6,9 +6,14 @@
 'use strict'
 const requestManager = require("../../core/request-manager");
 const API = require("../../../nr-security-api");
+const routeManager = require('../../core/route-manager');
 const logger = API.getLogger();
+const lodash = require('lodash');
+const { ATTHERATE, DOUBLE_DOLLAR, EMPTY_STR } = require('../../core/constants');
 
 const semver = require('semver')
+const fs = require('fs');
+const path = require('path');
 
 module.exports = function initialize(shim, nextjs) {
   const nextVersion = shim.require('./package.json').version
@@ -16,6 +21,23 @@ module.exports = function initialize(shim, nextjs) {
 
   const nextServer = nextjs.default;
   hookRunAPI(shim, nextServer.prototype, nextVersion);
+
+  //TODO need to update for API endpoints
+  try {
+    const appRoot = process.env.PWD;
+    const searchPath = appRoot + '/.next/server/pages/api';
+    const allAPIEndpoints = getAllAPIEndpoints(searchPath);
+    logger.debug("allAPIEndpoints:", allAPIEndpoints);
+    for (let index = 0; index < allAPIEndpoints.length; index++) {
+      const element = allAPIEndpoints[index];
+      let key = "*" + ATTHERATE + element;
+      routeManager.setRoute(key, EMPTY_STR);
+    }
+  } catch (error) {
+    logger.debug("Error while getting all API end points for next.js", error);
+  }
+
+
 }
 
 /**
@@ -91,3 +113,33 @@ function extractParams(shim, page, params) {
   }
 }
 
+
+/**
+ * Utility to scan pages directory to get all avaible routes
+ * @param {*} dir 
+ * @returns 
+ */
+const getAllAPIEndpoints = (dir) => {
+  logger.debug("dir is:", dir)
+  const apiEndpoints = [];
+
+  const scanDirectory = (currentDir) => {
+    logger.debug("currentDir is:", currentDir)
+    const files = fs.readdirSync(currentDir);
+
+    files.forEach((file) => {
+      const filePath = path.join(currentDir, file);
+      const isDirectory = fs.statSync(filePath).isDirectory();
+
+      if (isDirectory) {
+        scanDirectory(filePath);
+      } else {
+        const apiEndpoint = filePath.replace(`${dir}/`, '/api/').replace(/\.js*.*/, '');
+        apiEndpoints.push(apiEndpoint);
+      }
+    });
+  };
+
+  scanDirectory(dir);
+  return apiEndpoints;
+};

package/lib/instrumentation-security/index.js

@@ -235,6 +235,15 @@ newrelic.instrument({
   }
 })
 
+newrelic.instrument({
+  moduleName: '@grpc/grpc-js/build/src/call',
+  isEsm: true,
+  onRequire: require('./hooks/grpc-js/nr-grpc').wrapCall,
+  onError: function intrumentErrorHandler(err) {
+    logger.error(err.message, err.stack)
+  }
+})
+
 newrelic.instrument({
   moduleName: 'graphql/execution/execute',
   isEsm: true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@newrelic/security-agent",
-  "version": "2.3.1",
+  "version": "2.4.0",
   "description": "New Relic Security Agent for Node.js",
   "main": "index.js",
   "jsonVersion": "1.2.9",
@@ -39,7 +39,7 @@
     "url": "https://github.com/newrelic/csec-node-agent.git"
   },
   "dependencies": {
-    "axios": "^1.7.9",
+    "axios": "^1.8.4",
     "check-disk-space": "^3.4.0",
     "content-type": "^1.0.5",
     "cron": "^3.1.7",