@newrelic/security-agent 2.4.0 → 2.4.2

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+### v2.4.2 (2025-05-14)
+#### Bug fixes
+* Fixed usage of incorrect method
+
+### v2.4.1 (2025-05-13)
+#### Bug fixes
+* Only listen once for uncaughtException
+#### Miscellaneous chores
+* (deps-dev): bump koa from v2.14.2 to v2.16.1
+* (deps-dev): bump tar-fs from v2.1.1 to v2.1.2 
+
+
 ### v2.4.0 (2025-03-21)
 #### Features
 * Support for gRPC error reporting

package/lib/instrumentation-security/hooks/http/nr-http.js

@@ -46,9 +46,9 @@ const requestBodyLimit = 500;
 
 /**
  * Entry point of http module hook
- * @param {*} shim 
- * @param {*} mod 
- * @param {*} moduleName 
+ * @param {*} shim
+ * @param {*} mod
+ * @param {*} moduleName
  */
 function initialize(shim, mod, moduleName) {
   logger.info(`Instrumenting ${moduleName}`);
@@ -87,9 +87,9 @@ function setupRequestMapCleanup() {
 
 /**
  * Hook to intercept outbound http requests.
- * @param {*} shim 
- * @param {*} mod 
- * @param {*} moduleName 
+ * @param {*} shim
+ * @param {*} mod
+ * @param {*} moduleName
  */
 function outboundHook(shim, mod, method, moduleName) {
   if (API && API.getNRAgent() && API.getNRAgent().config.security.exclude_from_iast_scan.iast_detection_category.ssrf) {
@@ -167,7 +167,7 @@ function outboundHook(shim, mod, method, moduleName) {
 /**
  * Function to parse fuzzheaders and create temp files in case of dynamic scanning
  * Not functional
- * @param {*} fuzzheaders 
+ * @param {*} fuzzheaders
  */
 function parseFuzzheaders(requestData, transactionId) {
   let fuzzheaders = requestData.headers;
@@ -226,14 +226,14 @@ function parseFuzzheaders(requestData, transactionId) {
 
 /**
  * Utility function to add request data in a Map
- * @param {*} shim 
- * @param {*} request 
- * @param {*} resp 
+ * @param {*} shim
+ * @param {*} request
+ * @param {*} resp
  */
 function addRequestData(shim, request) {
   try {
     const data = Object.assign({});
-    const transaction = shim.tracer.getTransaction(); 
+    const transaction = shim.tracer.getTransaction();
     if (transaction) {
       data.protocol = (request.connection && request.connection.encrypted) ? 'https' : 'http';
       data.body = null;
@@ -280,10 +280,10 @@ function addRequestData(shim, request) {
 }
 
 /**
- * Wrappert to hook http.server.emit() 
- * @param {*} shim 
- * @param {*} mod 
- * @param {*} moduleName 
+ * Wrappert to hook http.server.emit()
+ * @param {*} shim
+ * @param {*} mod
+ * @param {*} moduleName
  */
 function emitHook(shim, mod, moduleName) {
   shim.wrap(mod && mod.Server && mod.Server.prototype, 'emit', function makeEmitWrapper(shim, fn) {
@@ -328,8 +328,8 @@ function emitHook(shim, mod, moduleName) {
 
 /**
  * Wrapper for http.createServer method
- * @param {*} shim 
- * @param {*} mod 
+ * @param {*} shim
+ * @param {*} mod
  */
 function createServerHook(shim, mod, moduleName) {
   shim.wrap(mod, 'createServer', function createServerWrapper(shim, fn) {
@@ -356,9 +356,9 @@ function createServerHook(shim, mod, moduleName) {
 }
 
 /**
- * Wrapper to hook http request body 
- * @param {*} shim 
- * @param {*} mod 
+ * Wrapper to hook http request body
+ * @param {*} shim
+ * @param {*} mod
  */
 function onDataHook(shim, mod) {
   shim.wrap(mod, '1', function makeOnDataWrapper(shim, fn) {
@@ -399,13 +399,13 @@ function onDataHook(shim, mod) {
 }
 
 /**
- * Wrapper to hook response.write() and reponse.end() method 
- * @param {*} resp 
- * @param {*} req 
- * @param {*} shim 
+ * Wrapper to hook response.write() and reponse.end() method
+ * @param {*} resp
+ * @param {*} req
+ * @param {*} shim
  */
 function responseHook(resp, req, shim) {
-  // wrapper for response.write() 
+  // wrapper for response.write()
   resp.res = {};
   resp.res.body = EMPTY_STRING;
 
@@ -419,7 +419,7 @@ function responseHook(resp, req, shim) {
       return fn.apply(this, arguments);
     }
   })
-  // wrapper for response.end() 
+  // wrapper for response.end()
   shim.wrap(resp, 'end', function makeEndWrapper(shim, fn) {
     if (!shim.isFunction(fn)) {
       return fn
@@ -460,7 +460,7 @@ function responseHook(resp, req, shim) {
       const dynamicScanningFlag = policy.data ? (policy.data.vulnerabilityScan?.enabled && policy.data.vulnerabilityScan.iastScan.enabled) : false;
       const type = response.getHeader(CONTENT_TYPE);
       let isUnsupportedType = isUnsupportedContentType(type, response);
-      
+
       if (request && (construct || dynamicScanningFlag) && !isUnsupportedType) {
         const args = [];
         args.push(construct);
@@ -478,8 +478,8 @@ function responseHook(resp, req, shim) {
 }
 /**
  * Utility to check unsupported content types
- * @param {*} conType 
- * @returns 
+ * @param {*} conType
+ * @returns
  */
 function isUnsupportedContentType(conType, response) {
   try {
@@ -570,10 +570,10 @@ function responseBodyCompute(response, args) {
 
 /**
  * Callback hook to generate exit event
- * @param {*} shim 
- * @param {*} mod 
- * @param {*} fun 
- * @param {*} secEvent 
+ * @param {*} shim
+ * @param {*} mod
+ * @param {*} fun
+ * @param {*} secEvent
  */
 function callbackHook(shim, mod, fun, secEvent) {
   shim.secEvent = secEvent;
@@ -593,9 +593,9 @@ function callbackHook(shim, mod, fun, secEvent) {
 
 /**
  * Utility to check if child path is inside parent path
- * @param {*} childPath 
- * @param {*} parentPath 
- * @returns 
+ * @param {*} childPath
+ * @param {*} parentPath
+ * @returns
  */
 function isPathInside(childPath, parentPath) {
   childPath = path.resolve(childPath);
@@ -614,7 +614,7 @@ function isPathInside(childPath, parentPath) {
 
 /**
  * Delete Temporary file for IAST. Do not call this in RASP
- * @param {*} file 
+ * @param {*} file
  */
 function deleteTempFileForIAST(file) {
   try {
@@ -629,7 +629,12 @@ function deleteTempFileForIAST(file) {
 /**
  * Collect and report the uncaught Exception
  */
-process.on('uncaughtException', (err, origin) => {
+const listeners = process.listeners('uncaughtException')
+if (listeners.indexOf(uncaughtListener) === -1) {
+  process.on('uncaughtException', uncaughtListener);
+}
+
+function uncaughtListener(err, origin) {
   console.error(err);
   if (uncaughtExceptionReportFlag) {
     process.exit(1);
@@ -641,12 +646,12 @@ process.on('uncaughtException', (err, origin) => {
   }
   logger.error("An uncaughtException is detected:", err);
   uncaughtExceptionReportFlag = true;
-});
+}
 
 /**
  * utility to parse response headers for cookie check
- * @param {*} headersString 
- * @returns 
+ * @param {*} headersString
+ * @returns
  */
 function responseRawHeaderParsing(headersString) {
   let setCookieValue;
@@ -666,8 +671,8 @@ function responseRawHeaderParsing(headersString) {
 
 /**
  * Utility to check insecure cookie settings
- * @param {*} response 
- * @param {*} shim 
+ * @param {*} response
+ * @param {*} shim
  */
 function secureCookieCheck(response, shim) {
   let cookieHeader = response.getHeader('set-cookie') ? response.getHeader('set-cookie') : responseRawHeaderParsing(response._header);
@@ -738,8 +743,8 @@ function truncateStringToBytes(inputString, maxBytes) {
 
 /**
  * Utility to generate trustboundary events.
- * @param {*} sessionObject 
- * @param {*} shim 
+ * @param {*} sessionObject
+ * @param {*} shim
  */
 function trustBoundaryCheck(sessionObject, shim) {
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@newrelic/security-agent",
-  "version": "2.4.0",
+  "version": "2.4.2",
   "description": "New Relic Security Agent for Node.js",
   "main": "index.js",
   "jsonVersion": "1.2.9",