newrelic 6.12.0 → 6.13.2

package/CONTRIBUTING.md

@@ -20,9 +20,9 @@ licensing restrictions.
 
 ### Code of Conduct
 
-Before contributing please read the [code of conduct](./CODE_OF_CONDUCT.md)
+Before contributing please read the [code of conduct](https://github.com/newrelic/.github/blob/main/CODE_OF_CONDUCT.md)
 
-Note that our [code of conduct](./CODE_OF_CONDUCT.md) applies to all platforms
+Note that our [code of conduct](https://github.com/newrelic/.github/blob/main/CODE_OF_CONDUCT.md) applies to all platforms
 and venues related to this project; please follow it in all your interactions
 with the project and its participants.
 
@@ -53,7 +53,7 @@ When contributing, keep in mind that New Relic customers (that's you!) are runni
 
 Be aware that the instrumentation needs to work with a wide range of versions of the instrumented modules, and that code that looks nonsensical or overcomplicated may be that way for compatibility-related reasons. Read all the comments and check the related tests before deciding whether existing code is incorrect.
 
-If you’re planning on contributing a new feature or an otherwise complex contribution, we kindly ask you to start a conversation with the maintainer team by opening up an Github issue first. 
+If you’re planning on contributing a new feature or an otherwise complex contribution, we kindly ask you to start a conversation with the maintainer team by opening up an Github issue first.
 
 ### General Guidelines
 

package/NEWS.md

@@ -1,9 +1,45 @@
+## 6.13.2 (2020-10-13):
+
+* Removed lodash as a development dependency
+
+* Check for named pipe existence before each flush
+
+  This removes the cached value used in 6.13.1
+
+* Update shim documentation
+
+  Thank you to @ronen-e for the contribution!
+
+## 6.13.1 (2020-09-24):
+
+* Fixed named-pipe check for lambda invocations to avoid race-condition.
+
+  Named-pipe existence will now be checked just prior to first write and then cached.
+
+* Updated README with community-plus header.
+
+* Updated README config copy example.
+
+* Added Open Source Policy workflow.
+
+* Removed repository CoC in favor of centralized CoC at org root.
+
+### 6.13.0 (2020-08-25):
+
+* Added ability for the agent to write to a named pipe, instead of stdout, when in serverless mode.
+
+### 6.12.1 (2020-08-20):
+
+* **Security fix:** Resolves an issue where transaction traces will still capture the request URI when the Node.js agent is configured to exclude the 'request.uri' attribute. This can be problematic for certain customers in environments where sensitive information is included in the URI. See security bulletin [NR20-02](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr20-02).
+
+  The request URI will now be excluded from transaction traces if the 'request.uri' attribute has been set to be excluded at either the top-level 'attributes.exclude' configuration or at the 'transaction_tracer.attributes.exclude' configuration.
+
 ### 6.12.0 (2020-08-11):
 
-* Fixes obfuscation of SQL queries with large data inserts.  
+* Fixes obfuscation of SQL queries with large data inserts.
 Special thanks to Tomáš Hanáček (@tomashanacek) for tracking down the issue and providing the fix.
 * On failed instrumentation, prevent multiple requires from re-wrapping shims.
-Special thanks to Ryan Copley (@RyanCopley) for the contribution. 
+Special thanks to Ryan Copley (@RyanCopley) for the contribution.
 * Upgrade `async` to `v3.2.0`. Special thanks to Yohan Siguret (@Crow-EH) for the contribution
 * Bumped `@newrelic/native-metrics` to `^5.3.0`.
 * Bumped `@newrelic/aws-sdk` to `^2.0.0`.

package/README.md

@@ -1,4 +1,4 @@
-[![Community Project header](https://github.com/newrelic/opensource-website/raw/master/src/images/categories/Community_Project.png)](https://opensource.newrelic.com/oss-category/#community-project)
+[![Community Plus header](https://github.com/newrelic/opensource-website/raw/master/src/images/categories/Community_Plus.png)](https://opensource.newrelic.com/oss-category/#community-plus)
 
 # New Relic's Node.js agent [![Server Smoke Tests][3]][4] [![Node Agent CI][5]][6]
 
@@ -20,11 +20,11 @@ To use New Relic's Node.js agent entails these three steps, which are described
 
 1. To install the agent for performance monitoring, use your favorite npm-based package manager and install the `newrelic` package into your application:
 
-    $ npm install newrelic
+    `$ npm install newrelic`
 
 2. Then, copy the stock configuration file to your program's base folder:
 
-    $ cp node_modules/newrelic/newrelic.js
+    `$ cp ./node_modules/newrelic/newrelic.js ./<your destination>`
 
 3. Now, add your New Relic license key and application/service name to that file:
 
@@ -172,4 +172,4 @@ The Node.js agent also uses source code from third-party libraries. You can find
 [3]: https://github.com/newrelic/node-newrelic/workflows/Server%20Smoke%20Tests/badge.svg
 [4]: https://github.com/newrelic/node-newrelic/actions?query=workflow%3A%22Server+Smoke+Tests%22
 [5]: https://github.com/newrelic/node-newrelic/workflows/Node%20Agent%20CI/badge.svg
-[6]: https://github.com/newrelic/node-newrelic/actions?query=workflow%3A%22Node+Agent+CI%22
+[6]: https://github.com/newrelic/node-newrelic/actions?query=workflow%3A%22Node+Agent+CI%22

package/THIRD_PARTY_NOTICES.md

@@ -48,7 +48,6 @@ code, the source code can be found at [https://github.com/newrelic/node-newrelic
 * [got](#got)
 * [http-errors](#http-errors)
 * [jsdoc](#jsdoc)
-* [lodash](#lodash)
 * [memcached](#memcached)
 * [minami](#minami)
 * [mongodb](#mongodb)
@@ -2197,61 +2196,6 @@ https://github.com/jmblog/color-themes-for-google-code-prettify
 
 ```
 
-### lodash
-
-This product includes source derived from [lodash](https://github.com/lodash/lodash) ([v4.17.15](https://github.com/lodash/lodash/tree/v4.17.15)), distributed under the [MIT License](https://github.com/lodash/lodash/blob/v4.17.15/LICENSE):
-
-```
-Copyright OpenJS Foundation and other contributors <https://openjsf.org/>
-
-Based on Underscore.js, copyright Jeremy Ashkenas,
-DocumentCloud and Investigative Reporters & Editors <http://underscorejs.org/>
-
-This software consists of voluntary contributions made by many
-individuals. For exact contribution history, see the revision history
-available at https://github.com/lodash/lodash
-
-The following license applies to all parts of this software except as
-documented below:
-
-====
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-"Software"), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
-LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
-OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
-WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-====
-
-Copyright and related rights for sample code are waived via CC0. Sample
-code is defined as all source code displayed within the prose of the
-documentation.
-
-CC0: http://creativecommons.org/publicdomain/zero/1.0/
-
-====
-
-Files located in the node_modules and vendor directories are externally
-maintained libraries used by this software which have their own
-licenses; we recommend you read them, as their terms may differ from the
-terms above.
-
-```
-
 ### memcached
 
 This product includes source derived from [memcached](https://github.com/3rd-Eden/node-memcached) ([v2.2.2](https://github.com/3rd-Eden/node-memcached/tree/v2.2.2)), distributed under the [MIT License](https://github.com/3rd-Eden/node-memcached/blob/v2.2.2/LICENSE):

package/lib/attributes.js

@@ -108,7 +108,7 @@ class Attributes {
   addAttribute(destinations, key, value, truncateExempt = false) {
     if (this.attributeCount + 1 > this.limit) {
       return logger.debug(
-        `Maximum number of custom attributes have been added.  
+        `Maximum number of custom attributes have been added.
         Dropping attribute ${key} with ${value} type.`
       )
     }
@@ -151,6 +151,18 @@ class Attributes {
       }
     }
   }
+
+  /**
+   * Returns true if a given key is valid for any of the
+   * provided destinations.
+   *
+   * @param {DESTINATIONS} destinations
+   * @param {string} key
+   */
+  hasValidDestination(destinations, key) {
+    const validDestinations = this.filter(destinations, key)
+    return !!validDestinations
+  }
 }
 
 /**

package/lib/collector/serverless.js

@@ -14,6 +14,9 @@ const stringify = require('json-stringify-safe')
 const PAYLOAD_VERSION = 1
 const PAYLOAD_MARKER = 'NR_LAMBDA_MONITORING'
 
+const path = require('path')
+const defaultPipePath = path.resolve('/tmp', 'newrelic-telemetry')
+
 class ServerlessCollector {
   /**
    * Constructs a new serverless collector instance with the give agent.
@@ -24,7 +27,7 @@ class ServerlessCollector {
    *
    * @param {Agent} agent - The agent this collector will use
    */
-  constructor(agent) {
+  constructor(agent, pipePath) {
     this._agent = agent
     this.enabled = true
     this.metadata = {
@@ -35,6 +38,7 @@ class ServerlessCollector {
       agent_version: agent.version
     }
     this.payload = {}
+    this.pipePath = pipePath || process.env.NEWRELIC_PIPE_PATH || defaultPipePath
   }
 
   /**
@@ -243,6 +247,36 @@ class ServerlessCollector {
     }
   }
 
+  /**
+   * Writes payload to pipe
+   */
+  flushToPipeSync(payload) {
+    try {
+      fs.writeFileSync(this.pipePath, payload)
+      return true
+    } catch (e) {
+      logger.warn('Error attempting to write to pipe, falling back to stdout', e)
+      return false
+    }
+  }
+
+  flushToStdOut(serializedPayload, payloadLength, sync = false) {
+    if (sync) {
+      // Long log lines have been truncated at 65538
+      // Guarantees process.stdout will block, so long logs
+      // won't be truncated if process.exit() is called early.
+      const s = process.stdout
+      payloadLength > 65000 &&
+      s._handle &&
+      s._handle.setBlocking &&
+      s._handle.setBlocking(true)
+
+      fs.writeSync(process.stdout.fd, serializedPayload)
+    } else {
+      process.stdout.write(serializedPayload)
+    }
+  }
+
   /**
    * Internal method to handle flushing to stdout.
    *
@@ -258,19 +292,10 @@ class ServerlessCollector {
       payload
     ]) + '\n'
 
-    if (sync) {
-      // Long log lines have been truncated at 65538
-      // Guarantees process.stdout will block, so long logs
-      // won't be truncated if process.exit() is called early.
-      const s = process.stdout
-      payload.length > 65000 &&
-      s._handle &&
-      s._handle.setBlocking &&
-      s._handle.setBlocking(true)
+    const didUsePipe = fs.existsSync(this.pipePath) && this.flushToPipeSync(serializedPayload)
 
-      fs.writeSync(process.stdout.fd, serializedPayload)
-    } else {
-      process.stdout.write(serializedPayload)
+    if (!didUsePipe) {
+      this.flushToStdOut(serializedPayload, payload.length, sync)
     }
   }
 }

package/lib/prioritized-attributes.js

@@ -139,6 +139,18 @@ class PrioritizedAttributes {
     }
   }
 
+  /**
+   * Returns true if a given key is valid for any of the
+   * provided destinations.
+   *
+   * @param {DESTINATIONS} destinations
+   * @param {string} key
+   */
+  hasValidDestination(destinations, key) {
+    const validDestinations = this.filter(destinations, key)
+    return !!validDestinations
+  }
+
   _getDroppableAttributeKey(incomingPriority) {
     // There will never be anything lower priority to drop
     if (incomingPriority === ATTRIBUTE_PRIORITY.LOW) {

package/lib/transaction/trace/index.js

@@ -15,6 +15,8 @@ var {DESTINATIONS} = require('../../config/attribute-filter')
 var FROM_MILLIS = 1e-3
 const ATTRIBUTE_SCOPE = 'transaction'
 
+const REQUEST_URI_KEY = 'request.uri'
+const UNKNOWN_URI_PLACEHOLDER = '/Unknown'
 
 /**
  * A Trace holds the root of the Segment graph and produces the final
@@ -293,11 +295,13 @@ Trace.prototype._generatePayload = function _generatePayload(data) {
     syntheticsResourceId = this.transaction.syntheticsData.resourceId
   }
 
+  const requestUri = this._getRequestUri()
+
   return [
     this.root.timer.start, // start
     this.transaction.getResponseTimeInMillis(),  // response time
     this.transaction.getFullName(),              // path
-    this.transaction.url,  // request.uri
+    requestUri,  // request.uri
     data,                   // encodedCompressedData
     this.transaction.id,    // guid
     null,                   // reserved for future use
@@ -307,6 +311,25 @@ Trace.prototype._generatePayload = function _generatePayload(data) {
   ]
 }
 
+/**
+ * Returns the transaction URL if attribute is not exluded globally or
+ * for transaction traces. Returns '/Unknown' if included but not known.
+ *
+ * The URI on a trace is a special attribute. It is included as a positional field,
+ * not as an "agent attribute", to avoid having to decompress on the backend.
+ * But it still needs to be gaited by the same attribute exclusion/inclusion
+ * rules so sensitive information can be removed.
+ */
+Trace.prototype._getRequestUri = function _getRequestUri() {
+  const canAddUri = this.attributes.hasValidDestination(DESTINATIONS.TRANS_TRACE, REQUEST_URI_KEY)
+  let requestUri = null // must be null if excluded
+  if (canAddUri) {
+    requestUri = this.transaction.url || UNKNOWN_URI_PLACEHOLDER
+  }
+
+  return requestUri
+}
+
 /**
  * Serializes the trace into the expected JSON format to be sent.
  *

package/newrelic.js

@@ -28,7 +28,7 @@ exports.config = {
      *
      * @env NEW_RELIC_DISTRIBUTED_TRACING_ENABLED
      */
-    enabled: false
+    enabled: false,
   },
   logging: {
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "newrelic",
-  "version": "6.12.0",
+  "version": "6.13.2",
   "author": "New Relic Node.js agent team <nodejs@newrelic.com>",
   "license": "Apache-2.0",
   "contributors": [
@@ -174,7 +174,6 @@
     "got": "^8.0.1",
     "http-errors": "^1.7.3",
     "jsdoc": "^3.6.3",
-    "lodash": "^4.17.14",
     "memcached": ">=0.2.8",
     "minami": "^1.1.1",
     "mongodb": "^3.3.3",

package/third_party_manifest.json

@@ -1,5 +1,5 @@
 {
-  "lastUpdated": "Mon Aug 03 2020 12:31:39 GMT-0700 (Pacific Daylight Time)",
+  "lastUpdated": "Tue Oct 13 2020 14:24:25 GMT-0700 (Pacific Daylight Time)",
   "projectName": "New Relic Node Agent",
   "projectUrl": "https://github.com/newrelic/node-newrelic",
   "includeDev": true,
@@ -358,19 +358,6 @@
       "publisher": "Michael Mathews",
       "email": "micmath@gmail.com"
     },
-    "lodash@4.17.15": {
-      "name": "lodash",
-      "version": "4.17.15",
-      "range": "^4.17.14",
-      "licenses": "MIT",
-      "repoUrl": "https://github.com/lodash/lodash",
-      "versionedRepoUrl": "https://github.com/lodash/lodash/tree/v4.17.15",
-      "licenseFile": "node_modules/lodash/LICENSE",
-      "licenseUrl": "https://github.com/lodash/lodash/blob/v4.17.15/LICENSE",
-      "licenseTextSource": "file",
-      "publisher": "John-David Dalton",
-      "email": "john.david.dalton@gmail.com"
-    },
     "memcached@2.2.2": {
       "name": "memcached",
       "version": "2.2.2",

package/CODE_OF_CONDUCT.md

@@ -1,5 +0,0 @@
-### Hello! We're glad you've joined us. 
-
-We believe participation in our community should be a harassment free experience for everyone. 
-
-Learn more about our guidelines and principles by reading our [Code of Conduct](https://opensource.newrelic.com/code-of-conduct/) on our Open Source Website.