newrelic 10.6.0 → 10.6.1

package/NEWS.md

@@ -1,3 +1,9 @@
+### v10.6.1 (2023-08-01)
+
+#### Security Improvements
+
+* updated ESM loader to track instrumentation by url in a map instead of in url to avoid remote code execution. ([#1741](https://github.com/newrelic/node-newrelic/pull/1741)) ([c8dc779](https://github.com/newrelic/node-newrelic/commit/c8dc779c7799b234290b6f7eb1d0a4e07d692ef9))
+
 ### v10.6.0 (2023-07-26)
 
 #### Miscellaneous Chores

package/esm-loader.mjs

@@ -89,14 +89,10 @@ export async function resolve(specifier, context, nextResolve) {
       })
 
       // Keep track of what we've registered so we don't double register (see: https://github.com/newrelic/node-newrelic/issues/1646)
-      registeredSpecifiers.set(url, specifier)
+      registeredSpecifiers.set(url, { specifier })
     } else if (format === 'module') {
-      registeredSpecifiers.set(url, specifier)
-      const modifiedUrl = new URL(url)
-      // add a query param to the resolved url so the load hook below knows
-      // to rewrite and wrap the source code
-      modifiedUrl.searchParams.set('hasNrInstrumentation', 'true')
-      resolvedModule.url = modifiedUrl.href
+      addNrInstrumentation(resolvedModule)
+      registeredSpecifiers.set(url, { specifier, hasNrInstrumentation: true })
     } else {
       logger.debug(`${specifier} is not a CommonJS nor ESM package, skipping for now.`)
     }
@@ -105,6 +101,38 @@ export async function resolve(specifier, context, nextResolve) {
   return resolvedModule
 }
 
+/**
+ * This is purely done so that we can import the incoming specifier
+ * in the load hook.  It used to be used to determine if instrumentation existed
+ * for specifier but we found a RCE with that solution.
+ *
+ * @param {object} resolvedModule the result of call resolve on a specifier
+ */
+function addNrInstrumentation(resolvedModule) {
+  const modifiedUrl = new URL(resolvedModule.url)
+  modifiedUrl.searchParams.set('hasNrInstrumentation', 'true')
+  resolvedModule.url = modifiedUrl.href
+}
+
+/**
+ * Extracts the href without query params
+ *
+ * @param {string} url url of specifier
+ * @returns {string} new url without hasNrInstrumentation query param
+ */
+function removeNrInstrumentation(url) {
+  let parsedUrl
+
+  try {
+    parsedUrl = new URL(url)
+    url = parsedUrl.href.split('?')[0]
+  } catch (err) {
+    logger.error('Unable to parse url: %s, msg: %s', url, err.message)
+  }
+
+  return url
+}
+
 /**
  * Hook chain responsible for determining how a URL should be interpreted, retrieved, and parsed.
  *
@@ -123,30 +151,17 @@ export async function load(url, context, nextLoad) {
     return nextLoad(url, context, nextLoad)
   }
 
-  let parsedUrl
-
-  try {
-    parsedUrl = new URL(url)
-  } catch (err) {
-    logger.error('Unable to parse url: %s, msg: %s', url, err.message)
-    return nextLoad(url, context, nextLoad)
-  }
+  url = removeNrInstrumentation(url)
 
-  const hasNrInstrumentation = parsedUrl.searchParams.get('hasNrInstrumentation')
+  const pkg = registeredSpecifiers.get(url)
 
-  if (!hasNrInstrumentation) {
+  if (!pkg?.hasNrInstrumentation) {
     return nextLoad(url, context, nextLoad)
   }
 
-  /**
-   * undo the work we did in the resolve hook above
-   * so we can properly rewrite source and not get in an infinite loop
-   */
-  parsedUrl.searchParams.delete('hasNrInstrumentation')
+  const { specifier } = pkg
 
-  const originalUrl = parsedUrl.href
-  const specifier = registeredSpecifiers.get(originalUrl)
-  const rewrittenSource = await wrapEsmSource(originalUrl, specifier)
+  const rewrittenSource = await wrapEsmSource(url, specifier)
   logger.debug(`Registered module instrumentation for ${specifier}.`)
 
   return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "newrelic",
-  "version": "10.6.0",
+  "version": "10.6.1",
   "author": "New Relic Node.js agent team <nodejs@newrelic.com>",
   "license": "Apache-2.0",
   "contributors": [