@newrelic/security-agent 2.4.1 → 2.4.3

package/CHANGELOG.md

@@ -1,23 +1,31 @@
+### v2.4.3 (2025-07-23)
+#### Bug fixes
+* Removed dependency sync-req and updated axios
+
+### v2.4.2 (2025-05-14)
+#### Bug fixes
+* Fixed usage of incorrect method
+
 ### v2.4.1 (2025-05-13)
 #### Bug fixes
 * Only listen once for uncaughtException
 #### Miscellaneous chores
 * (deps-dev): bump koa from v2.14.2 to v2.16.1
-* (deps-dev): bump tar-fs from v2.1.1 to v2.1.2 
+* (deps-dev): bump tar-fs from v2.1.1 to v2.1.2
 
 
 ### v2.4.0 (2025-03-21)
 #### Features
 * Support for gRPC error reporting
-* Support to detect API endpoints in next.js framework 
+* Support to detect API endpoints in next.js framework
 #### Miscellaneous chores
 * Updated axios to v1.8.4
 
 ### v2.3.2 (2025-03-11)
 #### Bug fixes
-* Updated axios to v1.8.2 
+* Updated axios to v1.8.2
 #### Miscellaneous chores
-* Updated readme 
+* Updated readme
 
 
 ### v2.3.1 (2025-02-04)
@@ -29,20 +37,20 @@
 #### Features
 * Added Support for VM module
 * IAST support for Next.js
-* Support for Insecure settings i.e crypto, hash and random modules 
+* Support for Insecure settings i.e crypto, hash and random modules
 
 #### Bug fixes
 * Fix for special characters in ws header
-* Fix for getting transaction in graphql instrumentation 
-* Fix for mongodb unit tests 
+* Fix for getting transaction in graphql instrumentation
+* Fix for mongodb unit tests
 
 #### Miscellaneous chores
 * deps-dev: bump undici from v5.28.4 to v5.28.5
-* Updated axios to v1.7.9 
+* Updated axios to v1.7.9
 
 ### v2.2.0 (2024-12-18)
 #### Features
-* Support for express 5.x 
+* Support for express 5.x
 * IAST support for GraphQL
 * Added support for trustboundary security events
 
@@ -51,7 +59,7 @@
 
 ### v2.1.1 (2024-11-07)
 #### Bug fixes
-* Fix for assignment to logger constant 
+* Fix for assignment to logger constant
 
 ### v2.1.0 (2024-11-05)
 #### Features
@@ -61,7 +69,7 @@
 * Added default values for scan_schedule, scan_controllers and exclude_from_iast_scan config
 * Fix for security home placeholder replacement in fuzz requests
 * Handling to not resolve file path in fs module instrumentation
-* Fix for batch size and condition of iast-data-request sending 
+* Fix for batch size and condition of iast-data-request sending
 #### Miscellaneous chores
 * Added requestURI field in http request for application-runtime-error
 * Updated instrumented to get the transaction directly instead of from the active segment
@@ -90,7 +98,7 @@
 #### Bug fixes
 * Fix for traceId in error reporting
 #### Miscellaneous chores
-* (deps): bumped axios from 1.6.8 to 1.7.4 
+* (deps): bumped axios from 1.6.8 to 1.7.4
 * (deps-dev): bumped ws from 7.5.9 to 8.18.0
 #### Continuous integration
 * Added Node.js v22.x to unit tests
@@ -98,26 +106,26 @@
 ### v1.4.0 (2024-06-24)
 #### Features
 * Added support to report application's errors while IAST scanning
-* Support to detect gRPC API endpoints 
+* Support to detect gRPC API endpoints
 #### Bug fixes
 * Remove additional headers added by IAST client
-* Fix for uncaught exception reporting 
+* Fix for uncaught exception reporting
 #### Miscellaneous chores
-* Updated package.json to bump ws from 8.14.2 to 8.17.1 
-* (deps-dev): bump @grpc/grpc-js from 1.9.12 to 1.10.9 
+* Updated package.json to bump ws from 8.14.2 to 8.17.1
+* (deps-dev): bump @grpc/grpc-js from 1.9.12 to 1.10.9
 * (deps-dev): bump braces from 3.0.2 to 3.0.3
-* (deps): bump ws from 8.14.2 to 8.17.1 
+* (deps): bump ws from 8.14.2 to 8.17.1
 
 ### v1.3.0 (2024-05-31)
 #### Features
 * Added route field in security event for API endpoint mapping
 #### Bug fixes
-* Fix for control commands acknowledgement in security agent 
-* Added assert for typeof response data in Reflected XSS validation 
-* Updated @grpc/grpc-js instrumentation to instrument submodules 
+* Fix for control commands acknowledgement in security agent
+* Added assert for typeof response data in Reflected XSS validation
+* Updated @grpc/grpc-js instrumentation to instrument submodules
 * Handling to convert header values into string
 #### Miscellaneous chores
-* Updated log level for critical messages 
+* Updated log level for critical messages
 * Readme update
 * (deps-dev): bump axios from 0.21.4 to 1.7.2
 
@@ -125,7 +133,7 @@
 #### Features
 * Added instrumentation for express framework's res.download() and res.sendFile()
 #### Bug fixes
-* Handling to decrypt fuzz header data for IAST scanning 
+* Handling to decrypt fuzz header data for IAST scanning
 * Logging and snapshot file fixes
 #### Miscellaneous chores
 * Prepend vulnerability case type with apiId
@@ -138,13 +146,13 @@
 
 ### v1.1.0 (2024-03-19)
 #### Features
-* IAST support for grpc 
+* IAST support for grpc
 * Functionality to report API endpoints of the application
 * IAST support for undici
 #### Bug fixes
 * Updated permissions for file/directory created by security agent
 #### Miscellaneous chores
-* Bumped follow-redirects from v1.15.2 to v1.15.4  
+* Bumped follow-redirects from v1.15.2 to v1.15.4
 * Updated axios to v1.6.8
 * Bumped ip from v2.0.0 to v2.0.1
 * Bumped undici from 5.28.2 to v5.28.3
@@ -152,7 +160,7 @@
 
 ### v1.0.1 (2024-02-07)
 #### Bug fixes
-* Reporting of framework in security event json 
+* Reporting of framework in security event json
 #### Miscellaneous chores
 * Updated software license to New Relic Software License Version 1.0
 * Ability to send critical messages on successful startup of agent
@@ -169,8 +177,8 @@
 #### Miscellaneous chores
 * Updated log event jsonName to "critical-messages"
 * Removed dependency @aws-sdk/client-lambda
-* Bumped follow-redirects from v1.15.2 to v1.15.4  
-* Upgraded axios to v1.6.5 
+* Bumped follow-redirects from v1.15.2 to v1.15.4
+* Upgraded axios to v1.6.5
 
 ### v0.6.0 (2024-01-03)
 #### Features
@@ -182,7 +190,7 @@
 * Fix for honouring probing interval from policy
 #### Miscellaneous chores
 * Added nestjs test cases
-* Additional logging for instrumented modules and methods 
+* Additional logging for instrumented modules and methods
 * Upgraded axios to v1.6.3
 * Removed pinned version for axios and check-disk-space
 * Update in lockfileVersion of package-lock.json
@@ -203,10 +211,10 @@
 
 ### v0.4.0 (2023-10-27)
 #### Features
-* Added event stats for RASP, IAST and exit events in healthcheck. 
+* Added event stats for RASP, IAST and exit events in healthcheck.
 #### Miscellaneous chores
 * Deps: Updated uuid to v9.0.1 and @aws-sdk/client-lambda to v3.405.0
-* Upgraded axios to 1.6.0 to resolve CVE-2023-45857 
+* Upgraded axios to 1.6.0 to resolve CVE-2023-45857
 #### Continuous integration
 * Removed Node.js 14.x from CI.
 * Added should_skip flag to skip CI based on label.

package/THIRD_PARTY_NOTICES.md

@@ -32,7 +32,6 @@ code, the source code can be found at [https://github.com/newrelic/csec-node-age
 * [request-ip](#request-ip)
 * [ringbufferjs](#ringbufferjs)
 * [semver](#semver)
-* [sync-request](#sync-request)
 * [unescape-js](#unescape-js)
 * [unescape](#unescape)
 * [uuid](#uuid)
@@ -78,7 +77,7 @@ code, the source code can be found at [https://github.com/newrelic/csec-node-age
 
 ### axios
 
-This product includes source derived from [axios](https://github.com/axios/axios) ([v1.8.4](https://github.com/axios/axios/tree/v1.8.4)), distributed under the [MIT License](https://github.com/axios/axios/blob/v1.8.4/LICENSE):
+This product includes source derived from [axios](https://github.com/axios/axios) ([v1.11.0](https://github.com/axios/axios/tree/v1.11.0)), distributed under the [MIT License](https://github.com/axios/axios/blob/v1.11.0/LICENSE):
 
 ```
 # Copyright (c) 2014-present Matt Zabriskie & Collaborators
@@ -532,32 +531,6 @@ IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
 ```
 
-### sync-request
-
-This product includes source derived from [sync-request](https://github.com/ForbesLindesay/sync-request) ([v6.1.0](https://github.com/ForbesLindesay/sync-request/tree/v6.1.0)), distributed under the [MIT License](https://github.com/ForbesLindesay/sync-request/blob/v6.1.0/LICENSE):
-
-```
-Copyright (c) 2014 Forbes Lindesay
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
-```
-
 ### unescape-js
 
 This product includes source derived from [unescape-js](https://github.com/iamakulov/unescape-js) ([v1.1.4](https://github.com/iamakulov/unescape-js/tree/v1.1.4)), distributed under the [MIT License](https://github.com/iamakulov/unescape-js/blob/v1.1.4/LICENSE):

package/lib/instrumentation-security/hooks/http/nr-http.js

@@ -46,9 +46,9 @@ const requestBodyLimit = 500;
 
 /**
  * Entry point of http module hook
- * @param {*} shim 
- * @param {*} mod 
- * @param {*} moduleName 
+ * @param {*} shim
+ * @param {*} mod
+ * @param {*} moduleName
  */
 function initialize(shim, mod, moduleName) {
   logger.info(`Instrumenting ${moduleName}`);
@@ -87,9 +87,9 @@ function setupRequestMapCleanup() {
 
 /**
  * Hook to intercept outbound http requests.
- * @param {*} shim 
- * @param {*} mod 
- * @param {*} moduleName 
+ * @param {*} shim
+ * @param {*} mod
+ * @param {*} moduleName
  */
 function outboundHook(shim, mod, method, moduleName) {
   if (API && API.getNRAgent() && API.getNRAgent().config.security.exclude_from_iast_scan.iast_detection_category.ssrf) {
@@ -167,7 +167,7 @@ function outboundHook(shim, mod, method, moduleName) {
 /**
  * Function to parse fuzzheaders and create temp files in case of dynamic scanning
  * Not functional
- * @param {*} fuzzheaders 
+ * @param {*} fuzzheaders
  */
 function parseFuzzheaders(requestData, transactionId) {
   let fuzzheaders = requestData.headers;
@@ -226,14 +226,14 @@ function parseFuzzheaders(requestData, transactionId) {
 
 /**
  * Utility function to add request data in a Map
- * @param {*} shim 
- * @param {*} request 
- * @param {*} resp 
+ * @param {*} shim
+ * @param {*} request
+ * @param {*} resp
  */
 function addRequestData(shim, request) {
   try {
     const data = Object.assign({});
-    const transaction = shim.tracer.getTransaction(); 
+    const transaction = shim.tracer.getTransaction();
     if (transaction) {
       data.protocol = (request.connection && request.connection.encrypted) ? 'https' : 'http';
       data.body = null;
@@ -280,10 +280,10 @@ function addRequestData(shim, request) {
 }
 
 /**
- * Wrappert to hook http.server.emit() 
- * @param {*} shim 
- * @param {*} mod 
- * @param {*} moduleName 
+ * Wrappert to hook http.server.emit()
+ * @param {*} shim
+ * @param {*} mod
+ * @param {*} moduleName
  */
 function emitHook(shim, mod, moduleName) {
   shim.wrap(mod && mod.Server && mod.Server.prototype, 'emit', function makeEmitWrapper(shim, fn) {
@@ -328,8 +328,8 @@ function emitHook(shim, mod, moduleName) {
 
 /**
  * Wrapper for http.createServer method
- * @param {*} shim 
- * @param {*} mod 
+ * @param {*} shim
+ * @param {*} mod
  */
 function createServerHook(shim, mod, moduleName) {
   shim.wrap(mod, 'createServer', function createServerWrapper(shim, fn) {
@@ -356,9 +356,9 @@ function createServerHook(shim, mod, moduleName) {
 }
 
 /**
- * Wrapper to hook http request body 
- * @param {*} shim 
- * @param {*} mod 
+ * Wrapper to hook http request body
+ * @param {*} shim
+ * @param {*} mod
  */
 function onDataHook(shim, mod) {
   shim.wrap(mod, '1', function makeOnDataWrapper(shim, fn) {
@@ -399,13 +399,13 @@ function onDataHook(shim, mod) {
 }
 
 /**
- * Wrapper to hook response.write() and reponse.end() method 
- * @param {*} resp 
- * @param {*} req 
- * @param {*} shim 
+ * Wrapper to hook response.write() and reponse.end() method
+ * @param {*} resp
+ * @param {*} req
+ * @param {*} shim
  */
 function responseHook(resp, req, shim) {
-  // wrapper for response.write() 
+  // wrapper for response.write()
   resp.res = {};
   resp.res.body = EMPTY_STRING;
 
@@ -419,7 +419,7 @@ function responseHook(resp, req, shim) {
       return fn.apply(this, arguments);
     }
   })
-  // wrapper for response.end() 
+  // wrapper for response.end()
   shim.wrap(resp, 'end', function makeEndWrapper(shim, fn) {
     if (!shim.isFunction(fn)) {
       return fn
@@ -460,7 +460,7 @@ function responseHook(resp, req, shim) {
       const dynamicScanningFlag = policy.data ? (policy.data.vulnerabilityScan?.enabled && policy.data.vulnerabilityScan.iastScan.enabled) : false;
       const type = response.getHeader(CONTENT_TYPE);
       let isUnsupportedType = isUnsupportedContentType(type, response);
-      
+
       if (request && (construct || dynamicScanningFlag) && !isUnsupportedType) {
         const args = [];
         args.push(construct);
@@ -478,8 +478,8 @@ function responseHook(resp, req, shim) {
 }
 /**
  * Utility to check unsupported content types
- * @param {*} conType 
- * @returns 
+ * @param {*} conType
+ * @returns
  */
 function isUnsupportedContentType(conType, response) {
   try {
@@ -570,10 +570,10 @@ function responseBodyCompute(response, args) {
 
 /**
  * Callback hook to generate exit event
- * @param {*} shim 
- * @param {*} mod 
- * @param {*} fun 
- * @param {*} secEvent 
+ * @param {*} shim
+ * @param {*} mod
+ * @param {*} fun
+ * @param {*} secEvent
  */
 function callbackHook(shim, mod, fun, secEvent) {
   shim.secEvent = secEvent;
@@ -593,9 +593,9 @@ function callbackHook(shim, mod, fun, secEvent) {
 
 /**
  * Utility to check if child path is inside parent path
- * @param {*} childPath 
- * @param {*} parentPath 
- * @returns 
+ * @param {*} childPath
+ * @param {*} parentPath
+ * @returns
  */
 function isPathInside(childPath, parentPath) {
   childPath = path.resolve(childPath);
@@ -614,7 +614,7 @@ function isPathInside(childPath, parentPath) {
 
 /**
  * Delete Temporary file for IAST. Do not call this in RASP
- * @param {*} file 
+ * @param {*} file
  */
 function deleteTempFileForIAST(file) {
   try {
@@ -630,7 +630,7 @@ function deleteTempFileForIAST(file) {
  * Collect and report the uncaught Exception
  */
 const listeners = process.listeners('uncaughtException')
-if (listeners.findIndex(uncaughtListener) === -1) {
+if (listeners.indexOf(uncaughtListener) === -1) {
   process.on('uncaughtException', uncaughtListener);
 }
 
@@ -650,8 +650,8 @@ function uncaughtListener(err, origin) {
 
 /**
  * utility to parse response headers for cookie check
- * @param {*} headersString 
- * @returns 
+ * @param {*} headersString
+ * @returns
  */
 function responseRawHeaderParsing(headersString) {
   let setCookieValue;
@@ -671,8 +671,8 @@ function responseRawHeaderParsing(headersString) {
 
 /**
  * Utility to check insecure cookie settings
- * @param {*} response 
- * @param {*} shim 
+ * @param {*} response
+ * @param {*} shim
  */
 function secureCookieCheck(response, shim) {
   let cookieHeader = response.getHeader('set-cookie') ? response.getHeader('set-cookie') : responseRawHeaderParsing(response._header);
@@ -743,8 +743,8 @@ function truncateStringToBytes(inputString, maxBytes) {
 
 /**
  * Utility to generate trustboundary events.
- * @param {*} sessionObject 
- * @param {*} shim 
+ * @param {*} sessionObject
+ * @param {*} shim
  */
 function trustBoundaryCheck(sessionObject, shim) {
   try {

package/lib/nr-security-agent/lib/core/applicationinfo.js

@@ -138,7 +138,7 @@ function ApplicationInfo () {
             ? `${process.env[AWS_LAMBDA_FUNCTION_NAME_ENV_IDENTIFIER]}:${lambdaVersion}`
             : `${lambdaARN}:${lambdaVersion}`;
         this.identifier.lambdaAWSSessionToken = process.env[AWS_SESSION_TOKEN_ENV_IDENTIFIER];
-        
+
     } else {
         this.identifier.kind = "HOST";
         this.identifier.envInfo = setHostProperties();
@@ -482,42 +482,9 @@ function getECSTaskId () {
 
 function populateECSInfo (ecsObj) {
     ecsObj.ecsTaskId = getECSTaskId();
-    const ecsData = getECSInfo();
-    if (!_.isEmpty(ecsData)) {
-        const imageId = ecsData.ImageID;
-        const imageName = ecsData.Image;
-
-        ecsObj.imageId = imageId;
-        ecsObj.imageName = imageName;
-
-        const labels = ecsData.Labels;
-
-        if (!_.isEmpty(labels)) {
-            const containerName = labels['com.amazonaws.ecs.container-name'];
-            const ecsTaskDefinitionFamily = labels['com.amazonaws.ecs.task-definition-family'];
-            const ecsTaskDefinitionVersion = labels['com.amazonaws.ecs.task-definition-version'];
-
-            ecsObj.containerName = containerName;
-            if (ecsTaskDefinitionFamily && ecsTaskDefinitionVersion) {
-                ecsObj.ecsTaskDefinition = ecsTaskDefinitionFamily + ':' + ecsTaskDefinitionVersion;
-            }
-        }
-    }
     return ecsObj;
 }
 
-function getECSInfo () {
-    const url = process.env.ECS_CONTAINER_METADATA_URI;
-    let json = {};
-    const request = require('sync-request');
-    try {
-        const res = request('GET', url);
-        const body = res.getBody();
-        json = JSON.parse(body);
-    } catch (error) {
-    }
-    return json;
-}
 
 function getApplicationSHAAndSizeFromWorker (applicationInfo, applicationPath) {
     const { Worker } = require('worker_threads');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@newrelic/security-agent",
-  "version": "2.4.1",
+  "version": "2.4.3",
   "description": "New Relic Security Agent for Node.js",
   "main": "index.js",
   "jsonVersion": "1.2.9",
@@ -39,7 +39,7 @@
     "url": "https://github.com/newrelic/csec-node-agent.git"
   },
   "dependencies": {
-    "axios": "^1.8.4",
+    "axios": "^1.11.0",
     "check-disk-space": "^3.4.0",
     "content-type": "^1.0.5",
     "cron": "^3.1.7",
@@ -57,7 +57,6 @@
     "request-ip": "^3.3.0",
     "ringbufferjs": "^2.0.0",
     "semver": "^7.5.4",
-    "sync-request": "^6.1.0",
     "unescape": "^1.0.1",
     "unescape-js": "^1.1.4",
     "uuid": "^9.0.1",