@newrelic/security-agent 2.3.2 → 2.4.1

package/CHANGELOG.md

@@ -1,3 +1,18 @@
+### v2.4.1 (2025-05-13)
+#### Bug fixes
+* Only listen once for uncaughtException
+#### Miscellaneous chores
+* (deps-dev): bump koa from v2.14.2 to v2.16.1
+* (deps-dev): bump tar-fs from v2.1.1 to v2.1.2 
+
+
+### v2.4.0 (2025-03-21)
+#### Features
+* Support for gRPC error reporting
+* Support to detect API endpoints in next.js framework 
+#### Miscellaneous chores
+* Updated axios to v1.8.4
+
 ### v2.3.2 (2025-03-11)
 #### Bug fixes
 * Updated axios to v1.8.2 

package/THIRD_PARTY_NOTICES.md

@@ -78,7 +78,7 @@ code, the source code can be found at [https://github.com/newrelic/csec-node-age
 
 ### axios
 
-This product includes source derived from [axios](https://github.com/axios/axios) ([v1.8.2](https://github.com/axios/axios/tree/v1.8.2)), distributed under the [MIT License](https://github.com/axios/axios/blob/v1.8.2/LICENSE):
+This product includes source derived from [axios](https://github.com/axios/axios) ([v1.8.4](https://github.com/axios/axios/tree/v1.8.4)), distributed under the [MIT License](https://github.com/axios/axios/blob/v1.8.4/LICENSE):
 
 ```
 # Copyright (c) 2014-present Matt Zabriskie & Collaborators

package/lib/instrumentation-security/hooks/grpc-js/nr-grpc.js

@@ -16,6 +16,7 @@ const grpcutils = require('../../core/grpc-utils');
 const routeManager = require('../../core/route-manager');
 let serverAddress;
 const ExceptionReporting = require('../../../nr-security-agent/lib/core/ExceptionReporting');
+const responseErrorSet = new Set([2, 12, 13, 14, 15])
 
 
 
@@ -58,6 +59,33 @@ module.exports.wrapStartCall = function wrappedClient(shim, callStream) {
   shim.wrap(callStream.Http2CallStream.prototype, 'start', wrapStart)
 }
 
+/**
+ * Wrapper for error collection
+ * @param {*} shim 
+ * @param {*} call 
+ */
+module.exports.wrapCall = function wrappedCall(shim, call) {
+  shim.wrap(call, 'callErrorFromStatus', function wrapCallErrorFromStatus(shim, fn) {
+    if (!shim.isFunction(fn)) {
+      return fn
+    }
+    return function wrappedCallErrorFromStatus() {
+      const errRes = fn.apply(this, arguments);
+      try {
+        let error = new Error(errRes.message);
+        error.stack = errRes.stack;
+        const request = requestManager.getRequest(shim);
+        if (request) {
+          ExceptionReporting.generate5xxReportingEvent(error, request);
+        }
+      } catch (error) {
+      }
+
+      return errRes;
+    }
+  })
+}
+
 module.exports.wrapServer = function wrappedServer(shim, server) {
   const grpcVersion = shim.require('./package.json').version
   logger.info("Instrumenting @grpc/grpc-js", grpcVersion)
@@ -109,6 +137,7 @@ function wrapStart(shim, original) {
       "path": method,
       "protocol": protocol,
     }
+
     if (request) {
       const traceObject = secUtils.getTraceObject(shim);
       const secMetadata = securityMetaData.getSecurityMetaData(request, urlObj, traceObject, secUtils.getExecutionId(), EVENT_TYPE.HTTP_REQUEST, EVENT_CATEGORY.HTTP)
@@ -256,11 +285,11 @@ function wrapCallback(shim, mod, method) {
           if (arguments[0].details && request) {
             ExceptionReporting.generateExceptionReportingEvent(arguments[0].details, request);
           }
-          //TODO GRPC response errors reporting 
-          // if (arguments[0].code && arguments[0].code > 0 && request) {
-          //   let responseCode = arguments[0].code
-          //   ExceptionReporting.generate5xxReportingEvent(null, request, responseCode);
-          // }
+
+          if (arguments[0].code && responseErrorSet.has(arguments[0].code) && request) {
+            let responseCode = arguments[0].code
+            ExceptionReporting.generate5xxReportingEvent(null, request, responseCode);
+          }
         }
       } catch (error) {
 
@@ -282,7 +311,7 @@ function wrapCallback(shim, mod, method) {
 function addRequestData(shim, type, path, args) {
   const data = Object.assign({});
   try {
-    const transaction = shim.tracer.getTransaction(); 
+    const transaction = shim.tracer.getTransaction();
     if (transaction) {
       data.method = path;
       data.url = path;

package/lib/instrumentation-security/hooks/http/nr-http.js

@@ -629,7 +629,12 @@ function deleteTempFileForIAST(file) {
 /**
  * Collect and report the uncaught Exception
  */
-process.on('uncaughtException', (err, origin) => {
+const listeners = process.listeners('uncaughtException')
+if (listeners.findIndex(uncaughtListener) === -1) {
+  process.on('uncaughtException', uncaughtListener);
+}
+
+function uncaughtListener(err, origin) {
   console.error(err);
   if (uncaughtExceptionReportFlag) {
     process.exit(1);
@@ -641,7 +646,7 @@ process.on('uncaughtException', (err, origin) => {
   }
   logger.error("An uncaughtException is detected:", err);
   uncaughtExceptionReportFlag = true;
-});
+}
 
 /**
  * utility to parse response headers for cookie check

package/lib/instrumentation-security/hooks/nextjs/nr-next.js

@@ -6,9 +6,14 @@
 'use strict'
 const requestManager = require("../../core/request-manager");
 const API = require("../../../nr-security-api");
+const routeManager = require('../../core/route-manager');
 const logger = API.getLogger();
+const lodash = require('lodash');
+const { ATTHERATE, DOUBLE_DOLLAR, EMPTY_STR } = require('../../core/constants');
 
 const semver = require('semver')
+const fs = require('fs');
+const path = require('path');
 
 module.exports = function initialize(shim, nextjs) {
   const nextVersion = shim.require('./package.json').version
@@ -16,6 +21,23 @@ module.exports = function initialize(shim, nextjs) {
 
   const nextServer = nextjs.default;
   hookRunAPI(shim, nextServer.prototype, nextVersion);
+
+  //TODO need to update for API endpoints
+  try {
+    const appRoot = process.env.PWD;
+    const searchPath = appRoot + '/.next/server/pages/api';
+    const allAPIEndpoints = getAllAPIEndpoints(searchPath);
+    logger.debug("allAPIEndpoints:", allAPIEndpoints);
+    for (let index = 0; index < allAPIEndpoints.length; index++) {
+      const element = allAPIEndpoints[index];
+      let key = "*" + ATTHERATE + element;
+      routeManager.setRoute(key, EMPTY_STR);
+    }
+  } catch (error) {
+    logger.debug("Error while getting all API end points for next.js", error);
+  }
+
+
 }
 
 /**
@@ -91,3 +113,33 @@ function extractParams(shim, page, params) {
   }
 }
 
+
+/**
+ * Utility to scan pages directory to get all avaible routes
+ * @param {*} dir 
+ * @returns 
+ */
+const getAllAPIEndpoints = (dir) => {
+  logger.debug("dir is:", dir)
+  const apiEndpoints = [];
+
+  const scanDirectory = (currentDir) => {
+    logger.debug("currentDir is:", currentDir)
+    const files = fs.readdirSync(currentDir);
+
+    files.forEach((file) => {
+      const filePath = path.join(currentDir, file);
+      const isDirectory = fs.statSync(filePath).isDirectory();
+
+      if (isDirectory) {
+        scanDirectory(filePath);
+      } else {
+        const apiEndpoint = filePath.replace(`${dir}/`, '/api/').replace(/\.js*.*/, '');
+        apiEndpoints.push(apiEndpoint);
+      }
+    });
+  };
+
+  scanDirectory(dir);
+  return apiEndpoints;
+};

package/lib/instrumentation-security/index.js

@@ -235,6 +235,15 @@ newrelic.instrument({
   }
 })
 
+newrelic.instrument({
+  moduleName: '@grpc/grpc-js/build/src/call',
+  isEsm: true,
+  onRequire: require('./hooks/grpc-js/nr-grpc').wrapCall,
+  onError: function intrumentErrorHandler(err) {
+    logger.error(err.message, err.stack)
+  }
+})
+
 newrelic.instrument({
   moduleName: 'graphql/execution/execute',
   isEsm: true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@newrelic/security-agent",
-  "version": "2.3.2",
+  "version": "2.4.1",
   "description": "New Relic Security Agent for Node.js",
   "main": "index.js",
   "jsonVersion": "1.2.9",
@@ -39,7 +39,7 @@
     "url": "https://github.com/newrelic/csec-node-agent.git"
   },
   "dependencies": {
-    "axios": "^1.8.2",
+    "axios": "^1.8.4",
     "check-disk-space": "^3.4.0",
     "content-type": "^1.0.5",
     "cron": "^3.1.7",