newrelic 12.5.2 → 12.6.0

package/NEWS.md

@@ -1,3 +1,18 @@
+### v12.6.0 (2024-10-30)
+
+#### Features
+
+* Added ARN and provider to Lambda segments ([#2674](https://github.com/newrelic/node-newrelic/pull/2674)) ([a23294c](https://github.com/newrelic/node-newrelic/commit/a23294c2d2cc665de5df1a0f3c9099dedbfbb896))
+* Added IAST configurations for scan scheduling and restrictions ([#2645](https://github.com/newrelic/node-newrelic/pull/2645)) ([13a627a](https://github.com/newrelic/node-newrelic/commit/13a627a1a1529dd8f8c93d0b9f582457c019a63e))
+
+#### Documentation
+
+* Updated compatibility report ([#2673](https://github.com/newrelic/node-newrelic/pull/2673)) ([e4d0503](https://github.com/newrelic/node-newrelic/commit/e4d0503934f7de45d3cdb6dbb4640a66cf8d8421))
+
+#### Miscellaneous chores
+
+* Replaced static openssl cert usage with in-process cert ([#2671](https://github.com/newrelic/node-newrelic/pull/2671)) ([72872f4](https://github.com/newrelic/node-newrelic/commit/72872f4313fd9bc6d2b358a735dc76b9cda1a489))
+
 ### v12.5.2 (2024-10-23)
 
 #### Features

package/lib/collector/http-agents.js

@@ -53,11 +53,14 @@ exports.proxyAgent = function proxyAgent(config) {
   }
   const proxyUrl = proxyOptions(config)
 
+  // Tests may supply 127.0.0.1 as the host, but SNI requires a hostname.
+  const servername = config.host
   const proxyOpts = {
     secureEndpoint: config.ssl,
     auth: proxyUrl.auth,
     ca: config?.certificates?.length ? config.certificates : [],
-    keepAlive: true
+    keepAlive: true,
+    servername
   }
 
   logger.info(`using proxy: ${proxyUrl}`)

package/lib/config/default.js

@@ -1318,6 +1318,147 @@ defaultConfig.definition = () => ({
           default: true
         }
       }
+    },
+
+    /**
+     * Unique test identifier when runnning IAST with CI/CD
+     */
+    iast_test_identifier: '',
+
+    /**
+     * IAST scan controllers to get more control over IAST analysis
+     */
+    scan_controllers: {
+      /**
+       * The maximum number of analysis probes or requests
+       * that can be sent to the application in one minute.
+       */
+      iast_scan_request_rate_limit: {
+        formatter: int,
+        default: 3600
+      },
+      /**
+       * The number of application instances for a specific entity where IAST analysis is performed.
+       *  Values are 0 or 1, 0 signifies run on all application instances
+       */
+      scan_instance_count: {
+        formatter: int,
+        default: 0
+      }
+    },
+    /**
+     * Schedule start and stop of IAST scan
+     */
+    scan_schedule: {
+      /**
+       * The delay field specifies the time in minutes
+       * before an IAST scan begins after the application starts
+       */
+      delay: {
+        formatter: int,
+        default: 0
+      },
+      /**
+       * The duration field specifies the amount of
+       * time in minutes that the IAST scan will run
+       */
+      duration: {
+        formatter: int,
+        default: 0
+      },
+      /**
+       * The schedule field specifies a unix cron expression that defines when the IAST scan should run.
+       * By default, schedule is disabled
+       *
+       */
+      schedule: '',
+      /**
+       * Allows IAST to actively collect trace data in the background
+       * and the security agent will use this collected data to perform
+       * an IAST scan at the scheduled time
+       */
+      always_sample_traces: {
+        formatter: boolean,
+        default: false
+      }
+    },
+
+    /**
+     * The exclude from IAST scan setting allows to exclude specific APIs,
+     * vulnerability categories, and parameters from IAST analysis.
+     */
+    exclude_from_iast_scan: {
+      /**
+       * Ignore specific APIs from IAST analysis.
+       * The regex pattern should provide a full match for the URL without the endpoint.
+       */
+      api: {
+        formatter: array,
+        default: []
+      },
+      /**
+       * Ignore specific HTTP request parameters from IAST analysis.
+       */
+      http_request_parameters: {
+        header: {
+          formatter: array,
+          default: []
+        },
+        query: {
+          formatter: array,
+          default: []
+        },
+        body: {
+          formatter: array,
+          default: []
+        }
+      },
+      /**
+       *  Allows users to specify categories of vulnerabilities
+       *  for which IAST analysis will be applied or ignored.
+       */
+      iast_detection_category: {
+        insecure_settings: {
+          formatter: boolean,
+          default: false
+        },
+        invalid_file_access: {
+          formatter: boolean,
+          default: false
+        },
+        sql_injection: {
+          formatter: boolean,
+          default: false
+        },
+        nosql_injection: {
+          formatter: boolean,
+          default: false
+        },
+        ldap_injection: {
+          formatter: boolean,
+          default: false
+        },
+        javascript_injection: {
+          formatter: boolean,
+          default: false
+        },
+        command_injection: {
+          formatter: boolean,
+          default: false
+        },
+        xpath_injection: {
+          formatter: boolean,
+          default: false
+        },
+        ssrf: {
+          formatter: boolean,
+          default: false
+        },
+        rxss: {
+          formatter: boolean,
+          default: false
+        }
+      }
     }
   },
 

package/lib/serverless/aws-lambda.js

@@ -249,7 +249,9 @@ class AwsLambda {
   _getAwsAgentAttributes(event, context) {
     const attributes = {
       'aws.lambda.arn': context.invokedFunctionArn,
-      'aws.requestId': context.awsRequestId
+      'aws.requestId': context.awsRequestId,
+      'cloud.resource_id': context.invokedFunctionArn,
+      'cloud.platform': 'aws_lambda'
     }
 
     const eventSourceInfo = this._detectEventType(event)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "newrelic",
-  "version": "12.5.2",
+  "version": "12.6.0",
   "author": "New Relic Node.js agent team <nodejs@newrelic.com>",
   "license": "Apache-2.0",
   "contributors": [
@@ -163,15 +163,14 @@
     "docs": "rm -rf ./out && jsdoc -c ./jsdoc-conf.jsonc --private -r .",
     "integration": "npm run prepare-test && npm run sub-install && BORP_CONF_FILE=.borp.int.yaml time c8 -o ./coverage/integration borp --timeout 600000 --reporter ./test/lib/test-reporter.mjs",
     "integration:esm": "NODE_OPTIONS='--loader=./esm-loader.mjs' BORP_CONF_FILE=.borp.int-esm.yaml time c8 -o ./coverage/integration-esm borp --reporter ./test/lib/test-reporter.mjs",
-    "prepare-test": "npm run ssl && npm run docker-env",
+    "prepare-test": "npm run docker-env",
     "lint": "eslint ./*.{js,mjs} lib test bin",
     "lint:fix": "eslint --fix, ./*.{js,mjs} lib test bin",
     "public-docs": "jsdoc -c ./jsdoc-conf.jsonc",
     "publish-docs": "./bin/publish-docs.sh",
     "services": "DOCKER_PLATFORM=linux/$(uname -m) docker compose up -d --wait",
     "services:stop": "docker compose down",
-    "smoke": "npm run ssl && time borp --timeout 180000 --reporter ./test/lib/test-reporter.mjs 'test/smoke/**/*.tap.js'",
-    "ssl": "./bin/ssl.sh",
+    "smoke": "time borp --timeout 180000 --reporter ./test/lib/test-reporter.mjs 'test/smoke/**/*.{test,tap}.js'",
     "sub-install": "node test/bin/install_sub_deps",
     "test": "npm run integration && npm run unit",
     "third-party-updates": "oss third-party manifest --includeOptDeps && oss third-party notices --includeOptDeps && git add THIRD_PARTY_NOTICES.md third_party_manifest.json",
@@ -195,7 +194,7 @@
     "newrelic-naming-rules": "./bin/test-naming-rules.js"
   },
   "dependencies": {
-    "@grpc/grpc-js": "^1.9.4",
+    "@grpc/grpc-js": "^1.12.2",
     "@grpc/proto-loader": "^0.7.5",
     "@newrelic/security-agent": "^2.0.0",
     "@tyriar/fibonacci-heap": "^2.0.7",
@@ -253,7 +252,6 @@
     "lint-staged": "^11.0.0",
     "lockfile-lint": "^4.9.6",
     "nock": "11.8.0",
-    "proxy": "^2.1.1",
     "proxyquire": "^1.8.0",
     "rimraf": "^2.6.3",
     "self-cert": "^2.0.0",