newrelic 10.5.0 → 10.6.1

package/NEWS.md

@@ -1,3 +1,21 @@
+### v10.6.1 (2023-08-01)
+
+#### Security Improvements
+
+* updated ESM loader to track instrumentation by url in a map instead of in url to avoid remote code execution. ([#1741](https://github.com/newrelic/node-newrelic/pull/1741)) ([c8dc779](https://github.com/newrelic/node-newrelic/commit/c8dc779c7799b234290b6f7eb1d0a4e07d692ef9))
+
+### v10.6.0 (2023-07-26)
+
+#### Miscellaneous Chores
+
+* **deps:** Updated @newrelic/security-agent to v0.2.0 ([#1737](https://github.com/newrelic/node-newrelic/pull/1737)) ([9bf2a01](https://github.com/newrelic/node-newrelic/commit/9bf2a011aed846a024d6445f557eb8eb7d2e5efe))
+* restored engines to >=14 until we actually drop support for Node 14 ([#1738](https://github.com/newrelic/node-newrelic/pull/1738)) ([8d66123](https://github.com/newrelic/node-newrelic/commit/8d66123105d25a3f949f0f5c2db53ecb7e9f2df0))
+
+#### Continuous Integration
+
+* Add Node.js 20.x to CI and remove 14.x ([#1603](https://github.com/newrelic/node-newrelic/pull/1603)) ([c4b008c](https://github.com/newrelic/node-newrelic/commit/c4b008c98c758ba3e669768a840e40dd8fe3e681))
+* update support statement ([#1733](https://github.com/newrelic/node-newrelic/pull/1733)) ([3013da9](https://github.com/newrelic/node-newrelic/commit/3013da977ed6dae70bef81b1f1cf0dbf4acbb37b))
+
 ### v10.5.0 (2023-07-20)
 
 #### Features

package/THIRD_PARTY_NOTICES.md

@@ -953,7 +953,7 @@ Apache License
 
 ### @newrelic/security-agent
 
-This product includes source derived from [@newrelic/security-agent](https://github.com/newrelic/csec-node-agent) ([v0.1.3](https://github.com/newrelic/csec-node-agent/tree/v0.1.3)), distributed under the [New Relic Pre-Release License](https://github.com/newrelic/csec-node-agent/blob/v0.1.3/LICENSE):
+This product includes source derived from [@newrelic/security-agent](https://github.com/newrelic/csec-node-agent) ([v0.2.0](https://github.com/newrelic/csec-node-agent/tree/v0.2.0)), distributed under the [New Relic Pre-Release License](https://github.com/newrelic/csec-node-agent/blob/v0.2.0/LICENSE):
 
 ```
 ## New Relic Pre-Release Software Notice

package/esm-loader.mjs

@@ -89,14 +89,10 @@ export async function resolve(specifier, context, nextResolve) {
       })
 
       // Keep track of what we've registered so we don't double register (see: https://github.com/newrelic/node-newrelic/issues/1646)
-      registeredSpecifiers.set(url, specifier)
+      registeredSpecifiers.set(url, { specifier })
     } else if (format === 'module') {
-      registeredSpecifiers.set(url, specifier)
-      const modifiedUrl = new URL(url)
-      // add a query param to the resolved url so the load hook below knows
-      // to rewrite and wrap the source code
-      modifiedUrl.searchParams.set('hasNrInstrumentation', 'true')
-      resolvedModule.url = modifiedUrl.href
+      addNrInstrumentation(resolvedModule)
+      registeredSpecifiers.set(url, { specifier, hasNrInstrumentation: true })
     } else {
       logger.debug(`${specifier} is not a CommonJS nor ESM package, skipping for now.`)
     }
@@ -105,6 +101,38 @@ export async function resolve(specifier, context, nextResolve) {
   return resolvedModule
 }
 
+/**
+ * This is purely done so that we can import the incoming specifier
+ * in the load hook.  It used to be used to determine if instrumentation existed
+ * for specifier but we found a RCE with that solution.
+ *
+ * @param {object} resolvedModule the result of call resolve on a specifier
+ */
+function addNrInstrumentation(resolvedModule) {
+  const modifiedUrl = new URL(resolvedModule.url)
+  modifiedUrl.searchParams.set('hasNrInstrumentation', 'true')
+  resolvedModule.url = modifiedUrl.href
+}
+
+/**
+ * Extracts the href without query params
+ *
+ * @param {string} url url of specifier
+ * @returns {string} new url without hasNrInstrumentation query param
+ */
+function removeNrInstrumentation(url) {
+  let parsedUrl
+
+  try {
+    parsedUrl = new URL(url)
+    url = parsedUrl.href.split('?')[0]
+  } catch (err) {
+    logger.error('Unable to parse url: %s, msg: %s', url, err.message)
+  }
+
+  return url
+}
+
 /**
  * Hook chain responsible for determining how a URL should be interpreted, retrieved, and parsed.
  *
@@ -123,30 +151,17 @@ export async function load(url, context, nextLoad) {
     return nextLoad(url, context, nextLoad)
   }
 
-  let parsedUrl
-
-  try {
-    parsedUrl = new URL(url)
-  } catch (err) {
-    logger.error('Unable to parse url: %s, msg: %s', url, err.message)
-    return nextLoad(url, context, nextLoad)
-  }
+  url = removeNrInstrumentation(url)
 
-  const hasNrInstrumentation = parsedUrl.searchParams.get('hasNrInstrumentation')
+  const pkg = registeredSpecifiers.get(url)
 
-  if (!hasNrInstrumentation) {
+  if (!pkg?.hasNrInstrumentation) {
     return nextLoad(url, context, nextLoad)
   }
 
-  /**
-   * undo the work we did in the resolve hook above
-   * so we can properly rewrite source and not get in an infinite loop
-   */
-  parsedUrl.searchParams.delete('hasNrInstrumentation')
+  const { specifier } = pkg
 
-  const originalUrl = parsedUrl.href
-  const specifier = registeredSpecifiers.get(originalUrl)
-  const rewrittenSource = await wrapEsmSource(originalUrl, specifier)
+  const rewrittenSource = await wrapEsmSource(url, specifier)
   logger.debug(`Registered module instrumentation for ${specifier}.`)
 
   return {

package/index.js

@@ -53,8 +53,8 @@ function initialize() {
       throw new Error(message)
     }
 
-    // TODO: Update this check when Node v20 support is added
-    if (psemver.satisfies('>=19.0.0')) {
+    // TODO: Update this check when Node v22 support is added
+    if (psemver.satisfies('>=21.0.0')) {
       logger.warn(
         'New Relic for Node.js %s has not been tested on Node.js %s. Please ' +
           'update the agent or downgrade your version of Node.js',

package/lib/environment.js

@@ -12,6 +12,7 @@ const logger = require('./logger').child({ component: 'environment' })
 const stringify = require('json-stringify-safe')
 const asyncEachLimit = require('./util/async-each-limit')
 const DISPATCHER_VERSION = 'Dispatcher Version'
+const semver = require('semver')
 
 // As of 1.7.0 you can no longer dynamically link v8
 // https://github.com/nodejs/io.js/commit/d726a177ed
@@ -260,7 +261,7 @@ function flattenVersions(packages) {
       try {
         return stringify(pair)
       } catch (err) {
-        logger.debug(err, 'Unabled to stringify package version')
+        logger.debug(err, 'Unable to stringify package version')
         return '<unknown>'
       }
     })
@@ -291,6 +292,19 @@ function remapConfigSettings() {
         addSetting(remapping[key], value)
       }
     })
+
+    maybeAddMissingProcessVars()
+  }
+}
+
+/**
+ * As of Node 19 DTrace and ETW are no longer bundled
+ * see: https://nodejs.org/en/blog/announcements/v19-release-announce#dtrace/systemtap/etw-support
+ */
+function maybeAddMissingProcessVars() {
+  if (semver.gte(process.version, '19.0.0')) {
+    addSetting(remapping.node_use_dtrace, 'no')
+    addSetting(remapping.node_use_etw, 'no')
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "newrelic",
-  "version": "10.5.0",
+  "version": "10.6.1",
   "author": "New Relic Node.js agent team <nodejs@newrelic.com>",
   "license": "Apache-2.0",
   "contributors": [
@@ -168,13 +168,11 @@
     "versioned-tests": "./bin/run-versioned-tests.sh",
     "update-changelog-version": "node ./bin/update-changelog-version",
     "checkout-external-versioned": "node ./test/versioned-external/checkout-external-tests.js",
-    "versioned": "npm run versioned:npm7",
-    "versioned:major": "VERSIONED_MODE=--major npm run versioned:npm7",
-    "versioned:npm6": "npm run checkout-external-versioned && npm run prepare-test && time ./bin/run-versioned-tests.sh",
-    "versioned:npm7": "npm run checkout-external-versioned && npm run prepare-test && NPM7=1 time ./bin/run-versioned-tests.sh",
-    "versioned:async-local": "NEW_RELIC_FEATURE_FLAG_ASYNC_LOCAL_CONTEXT=1 npm run versioned:npm7",
+    "versioned:major": "VERSIONED_MODE=--major npm run versioned",
+    "versioned": "npm run checkout-external-versioned && npm run prepare-test && NPM7=1 time ./bin/run-versioned-tests.sh",
+    "versioned:async-local": "NEW_RELIC_FEATURE_FLAG_ASYNC_LOCAL_CONTEXT=1 npm run versioned",
     "versioned:async-local:major": "NEW_RELIC_FEATURE_FLAG_ASYNC_LOCAL_CONTEXT=1 npm run versioned:major",
-    "versioned:security": "NEW_RELIC_SECURITY_AGENT_ENABLED=true npm run versioned:npm7",
+    "versioned:security": "NEW_RELIC_SECURITY_AGENT_ENABLED=true npm run versioned",
     "versioned:security:major": "NEW_RELIC_SECURITY_AGENT_ENABLED=true npm run versioned:major",
     "prepare": "husky install"
   },
@@ -187,7 +185,7 @@
     "@mrleebo/prisma-ast": "^0.5.2",
     "@newrelic/aws-sdk": "^6.0.0",
     "@newrelic/koa": "^7.1.1",
-    "@newrelic/security-agent": "0.1.3",
+    "@newrelic/security-agent": "0.2.0",
     "@newrelic/superagent": "^6.0.0",
     "@tyriar/fibonacci-heap": "^2.0.7",
     "concat-stream": "^2.0.0",