securenow 4.0.2 → 4.0.3

package/nextjs.js

@@ -25,6 +25,176 @@ const env = k => process.env[k] ?? process.env[k.toUpperCase()] ?? process.env[k
 
 let isRegistered = false;
 
+// Default sensitive fields to redact from request bodies
+const DEFAULT_SENSITIVE_FIELDS = [
+  'password', 'passwd', 'pwd', 'secret', 'token', 'api_key', 'apikey',
+  'access_token', 'auth', 'credentials', 'mysql_pwd', 'stripeToken',
+  'card', 'cardnumber', 'ccv', 'cvc', 'cvv', 'ssn', 'pin',
+];
+
+/**
+ * Redact sensitive fields from an object
+ */
+function redactSensitiveData(obj, sensitiveFields = DEFAULT_SENSITIVE_FIELDS) {
+  if (!obj || typeof obj !== 'object') return obj;
+  
+  const redacted = Array.isArray(obj) ? [...obj] : { ...obj };
+  
+  for (const key in redacted) {
+    const lowerKey = key.toLowerCase();
+    
+    // Check if field is sensitive
+    if (sensitiveFields.some(field => lowerKey.includes(field.toLowerCase()))) {
+      redacted[key] = '[REDACTED]';
+    } else if (typeof redacted[key] === 'object' && redacted[key] !== null) {
+      // Recursively redact nested objects
+      redacted[key] = redactSensitiveData(redacted[key], sensitiveFields);
+    }
+  }
+  
+  return redacted;
+}
+
+/**
+ * Redact sensitive data from GraphQL query strings
+ */
+function redactGraphQLQuery(query, sensitiveFields = DEFAULT_SENSITIVE_FIELDS) {
+  if (!query || typeof query !== 'string') return query;
+  
+  let redacted = query;
+  
+  // Redact sensitive fields in GraphQL arguments and variables
+  // Matches patterns like: password: "value" or password:"value" or password:'value'
+  sensitiveFields.forEach(field => {
+    // Match field: "value" or field: 'value' or field:"value" (with optional spaces)
+    const patterns = [
+      new RegExp(`(${field}\\s*:\\s*["'])([^"']+)(["'])`, 'gi'),
+      new RegExp(`(${field}\\s*:\\s*)([^\\s,})\n]+)`, 'gi'),
+    ];
+    
+    patterns.forEach(pattern => {
+      redacted = redacted.replace(pattern, (match, prefix, value, suffix) => {
+        if (suffix) {
+          return `${prefix}[REDACTED]${suffix}`;
+        } else {
+          return `${prefix}[REDACTED]`;
+        }
+      });
+    });
+  });
+  
+  return redacted;
+}
+
+/**
+ * Parse and capture request body safely
+ */
+async function captureRequestBody(request, maxSize = 10240) {
+  try {
+    const contentType = request.headers['content-type'] || '';
+    let body = '';
+    
+    // Collect body chunks
+    const chunks = [];
+    let size = 0;
+    
+    return new Promise((resolve) => {
+      request.on('data', (chunk) => {
+        size += chunk.length;
+        if (size <= maxSize) {
+          chunks.push(chunk);
+        }
+      });
+      
+      request.on('end', () => {
+        if (size > maxSize) {
+          resolve({ 
+            captured: false, 
+            reason: `Body too large (${size} bytes > ${maxSize} bytes)`,
+            size 
+          });
+          return;
+        }
+        
+        body = Buffer.concat(chunks).toString('utf8');
+        
+        // Parse based on content type
+        if (contentType.includes('application/json')) {
+          try {
+            const parsed = JSON.parse(body);
+            resolve({ 
+              captured: true, 
+              type: 'json', 
+              body: parsed,
+              size 
+            });
+          } catch (e) {
+            resolve({ 
+              captured: true, 
+              type: 'json', 
+              body: body.substring(0, 1000),
+              parseError: true,
+              size 
+            });
+          }
+        } else if (contentType.includes('application/graphql')) {
+          // GraphQL queries need redaction too!
+          resolve({ 
+            captured: true, 
+            type: 'graphql', 
+            body: body,  // Will be redacted later
+            size 
+          });
+        } else if (contentType.includes('multipart/form-data')) {
+          // Multipart is NOT captured (files can be huge)
+          resolve({ 
+            captured: false, 
+            type: 'multipart', 
+            reason: 'Multipart data not captured (file uploads)',
+            size 
+          });
+        } else if (contentType.includes('application/x-www-form-urlencoded')) {
+          try {
+            const params = new URLSearchParams(body);
+            const parsed = Object.fromEntries(params);
+            resolve({ 
+              captured: true, 
+              type: 'form', 
+              body: parsed,
+              size 
+            });
+          } catch (e) {
+            resolve({ 
+              captured: true, 
+              type: 'form', 
+              body: body.substring(0, 1000),
+              size 
+            });
+          }
+        } else {
+          resolve({ 
+            captured: true, 
+            type: 'text', 
+            body: body.substring(0, 1000),
+            size 
+          });
+        }
+      });
+      
+      request.on('error', () => {
+        resolve({ captured: false, reason: 'Stream error' });
+      });
+      
+      // Timeout after 100ms
+      setTimeout(() => {
+        resolve({ captured: false, reason: 'Timeout' });
+      }, 100);
+    });
+  } catch (error) {
+    return { captured: false, reason: error.message };
+  }
+}
+
 /**
  * Register SecureNow OpenTelemetry for Next.js using @vercel/otel
  * @param {Object} options - Optional configuration
@@ -86,6 +256,14 @@ function registerSecureNow(options = {}) {
 
     console.log('[securenow] 🚀 Next.js App → service.name=%s', serviceName);
 
+    // -------- Body Capture Configuration --------
+    const captureBody = String(env('SECURENOW_CAPTURE_BODY')) === '1' || 
+                       String(env('SECURENOW_CAPTURE_BODY')).toLowerCase() === 'true' ||
+                       options.captureBody === true;
+    const maxBodySize = parseInt(env('SECURENOW_MAX_BODY_SIZE') || '10240'); // 10KB default
+    const customSensitiveFields = (env('SECURENOW_SENSITIVE_FIELDS') || '').split(',').map(s => s.trim()).filter(Boolean);
+    const allSensitiveFields = [...DEFAULT_SENSITIVE_FIELDS, ...customSensitiveFields];
+
     // -------- Use @vercel/otel with enhanced configuration --------
     const { registerOTel } = require('@vercel/otel');
     const { HttpInstrumentation } = require('@opentelemetry/instrumentation-http');
@@ -98,11 +276,11 @@ function registerSecureNow(options = {}) {
         'vercel.region': process.env.VERCEL_REGION || undefined,
       },
       instrumentations: [
-        // Add HTTP instrumentation with request hooks to capture IP and headers
+        // Add HTTP instrumentation with request hooks to capture IP, headers, and body
         new HttpInstrumentation({
           requireParentforOutgoingSpans: false,
           requireParentforIncomingSpans: false,
-          requestHook: (span, request) => {
+          requestHook: async (span, request) => {
             try {
               // Capture client IP from various headers
               const headers = request.headers || {};
@@ -140,6 +318,50 @@ function registerSecureNow(options = {}) {
               if (headers['cf-ipcountry']) {
                 span.setAttribute('http.geo.country', headers['cf-ipcountry']);
               }
+
+              // -------- Capture Request Body --------
+              if (captureBody && request.method && ['POST', 'PUT', 'PATCH'].includes(request.method)) {
+                const contentType = headers['content-type'] || '';
+                
+                // Only capture JSON, GraphQL, and form data (not large files)
+                if (contentType.includes('application/json') || 
+                    contentType.includes('application/graphql') ||
+                    contentType.includes('application/x-www-form-urlencoded')) {
+                  
+                  const bodyResult = await captureRequestBody(request, maxBodySize);
+                  
+                  if (bodyResult.captured) {
+                    let redactedBody;
+                    
+                    // Redact based on type
+                    if (bodyResult.type === 'graphql') {
+                      // GraphQL: redact query string
+                      redactedBody = redactGraphQLQuery(bodyResult.body, allSensitiveFields);
+                    } else if (typeof bodyResult.body === 'object') {
+                      // JSON/Form: redact object properties
+                      redactedBody = redactSensitiveData(bodyResult.body, allSensitiveFields);
+                    } else {
+                      // Plain text: basic redaction
+                      redactedBody = bodyResult.body;
+                    }
+                    
+                    span.setAttributes({
+                      'http.request.body': typeof redactedBody === 'string' 
+                        ? redactedBody.substring(0, maxBodySize)
+                        : JSON.stringify(redactedBody).substring(0, maxBodySize),
+                      'http.request.body.type': bodyResult.type,
+                      'http.request.body.size': bodyResult.size,
+                    });
+                  } else {
+                    span.setAttribute('http.request.body.capture_failed', bodyResult.reason || 'unknown');
+                  }
+                } else if (contentType.includes('multipart/form-data')) {
+                  // Multipart is NOT captured at all
+                  span.setAttribute('http.request.body', '[MULTIPART - NOT CAPTURED]');
+                  span.setAttribute('http.request.body.type', 'multipart');
+                  span.setAttribute('http.request.body.note', 'File uploads not captured by design');
+                }
+              }
             } catch (error) {
               // Silently fail to not break the request
               console.debug('[securenow] Failed to capture request metadata:', error.message);
@@ -180,6 +402,11 @@ function registerSecureNow(options = {}) {
     isRegistered = true;
     console.log('[securenow] ✅ OpenTelemetry started for Next.js → %s', tracesUrl);
     console.log('[securenow] 📊 Auto-capturing: IP, User-Agent, Headers, Geographic data');
+    if (captureBody) {
+      console.log('[securenow] 📝 Request body capture: ENABLED (max: %d bytes, redacting %d sensitive fields)', maxBodySize, allSensitiveFields.length);
+    } else {
+      console.log('[securenow] 📝 Request body capture: DISABLED (set SECURENOW_CAPTURE_BODY=1 to enable)');
+    }
 
     // Optional test span
     if (String(env('SECURENOW_TEST_SPAN')) === '1') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securenow",
-  "version": "4.0.2",
+  "version": "4.0.3",
   "description": "OpenTelemetry instrumentation for Node.js and Next.js - Send traces to SigNoz or any OTLP backend",
   "type": "commonjs",
   "main": "register.js",
@@ -54,7 +54,10 @@
     "NEXTJS-QUICKSTART.md",
     "CUSTOMER-GUIDE.md",
     "AUTO-SETUP.md",
-    "AUTOMATIC-IP-CAPTURE.md"
+    "AUTOMATIC-IP-CAPTURE.md",
+    "REQUEST-BODY-CAPTURE.md",
+    "BODY-CAPTURE-QUICKSTART.md",
+    "REDACTION-EXAMPLES.md"
   ],
   "dependencies": {
     "@opentelemetry/api": "1.7.0",

package/tracing.js

@@ -37,6 +37,64 @@ const parseHeaders = str => {
   return out;
 };
 
+// Default sensitive fields to redact from request bodies
+const DEFAULT_SENSITIVE_FIELDS = [
+  'password', 'passwd', 'pwd', 'secret', 'token', 'api_key', 'apikey',
+  'access_token', 'auth', 'credentials', 'mysql_pwd', 'stripeToken',
+  'card', 'cardnumber', 'ccv', 'cvc', 'cvv', 'ssn', 'pin',
+];
+
+/**
+ * Redact sensitive fields from an object
+ */
+function redactSensitiveData(obj, sensitiveFields = DEFAULT_SENSITIVE_FIELDS) {
+  if (!obj || typeof obj !== 'object') return obj;
+  
+  const redacted = Array.isArray(obj) ? [...obj] : { ...obj };
+  
+  for (const key in redacted) {
+    const lowerKey = key.toLowerCase();
+    
+    if (sensitiveFields.some(field => lowerKey.includes(field.toLowerCase()))) {
+      redacted[key] = '[REDACTED]';
+    } else if (typeof redacted[key] === 'object' && redacted[key] !== null) {
+      redacted[key] = redactSensitiveData(redacted[key], sensitiveFields);
+    }
+  }
+  
+  return redacted;
+}
+
+/**
+ * Redact sensitive data from GraphQL query strings
+ */
+function redactGraphQLQuery(query, sensitiveFields = DEFAULT_SENSITIVE_FIELDS) {
+  if (!query || typeof query !== 'string') return query;
+  
+  let redacted = query;
+  
+  // Redact sensitive fields in GraphQL arguments and variables
+  sensitiveFields.forEach(field => {
+    // Match patterns: field: "value" or field: 'value' or field:"value"
+    const patterns = [
+      new RegExp(`(${field}\\s*:\\s*["'])([^"']+)(["'])`, 'gi'),
+      new RegExp(`(${field}\\s*:\\s*)([^\\s,})\n]+)`, 'gi'),
+    ];
+    
+    patterns.forEach(pattern => {
+      redacted = redacted.replace(pattern, (match, prefix, value, suffix) => {
+        if (suffix) {
+          return `${prefix}[REDACTED]${suffix}`;
+        } else {
+          return `${prefix}[REDACTED]`;
+        }
+      });
+    });
+  });
+  
+  return redacted;
+}
+
 // -------- diagnostics --------
 (() => {
   const L = (env('OTEL_LOG_LEVEL') || '').toLowerCase();
@@ -97,11 +155,103 @@ for (const n of (env('SECURENOW_DISABLE_INSTRUMENTATIONS') || '').split(',').map
   disabledMap[n] = { enabled: false };
 }
 
+// -------- Body Capture Configuration --------
+const captureBody = String(env('SECURENOW_CAPTURE_BODY')) === '1' || String(env('SECURENOW_CAPTURE_BODY')).toLowerCase() === 'true';
+const maxBodySize = parseInt(env('SECURENOW_MAX_BODY_SIZE') || '10240'); // 10KB default
+const customSensitiveFields = (env('SECURENOW_SENSITIVE_FIELDS') || '').split(',').map(s => s.trim()).filter(Boolean);
+const allSensitiveFields = [...DEFAULT_SENSITIVE_FIELDS, ...customSensitiveFields];
+
+// Configure HTTP instrumentation with body capture
+const { HttpInstrumentation } = require('@opentelemetry/instrumentation-http');
+const httpInstrumentation = new HttpInstrumentation({
+  requestHook: (span, request) => {
+    try {
+      if (captureBody && request.method && ['POST', 'PUT', 'PATCH'].includes(request.method)) {
+        const contentType = request.headers['content-type'] || '';
+        
+        if (contentType.includes('application/json') || 
+            contentType.includes('application/graphql') ||
+            contentType.includes('application/x-www-form-urlencoded')) {
+          
+          let body = '';
+          const chunks = [];
+          let size = 0;
+          
+          request.on('data', (chunk) => {
+            size += chunk.length;
+            if (size <= maxBodySize) {
+              chunks.push(chunk);
+            }
+          });
+          
+          request.on('end', () => {
+            if (size <= maxBodySize && chunks.length > 0) {
+              body = Buffer.concat(chunks).toString('utf8');
+              
+              try {
+                let redacted;
+                
+                if (contentType.includes('application/graphql')) {
+                  // GraphQL: redact query string
+                  redacted = redactGraphQLQuery(body, allSensitiveFields);
+                  span.setAttributes({
+                    'http.request.body': redacted.substring(0, maxBodySize),
+                    'http.request.body.type': 'graphql',
+                    'http.request.body.size': size,
+                  });
+                } else if (contentType.includes('application/json')) {
+                  // JSON: parse and redact object
+                  const parsed = JSON.parse(body);
+                  redacted = redactSensitiveData(parsed, allSensitiveFields);
+                  span.setAttributes({
+                    'http.request.body': JSON.stringify(redacted).substring(0, maxBodySize),
+                    'http.request.body.type': 'json',
+                    'http.request.body.size': size,
+                  });
+                } else if (contentType.includes('application/x-www-form-urlencoded')) {
+                  // Form: parse and redact
+                  const parsed = Object.fromEntries(new URLSearchParams(body));
+                  redacted = redactSensitiveData(parsed, allSensitiveFields);
+                  span.setAttributes({
+                    'http.request.body': JSON.stringify(redacted).substring(0, maxBodySize),
+                    'http.request.body.type': 'form',
+                    'http.request.body.size': size,
+                  });
+                }
+              } catch (e) {
+                // Parse error: capture as-is (truncated)
+                span.setAttribute('http.request.body', body.substring(0, 1000));
+                span.setAttribute('http.request.body.parse_error', true);
+              }
+            } else if (size > maxBodySize) {
+              span.setAttribute('http.request.body', `[TOO LARGE: ${size} bytes]`);
+              span.setAttribute('http.request.body.size', size);
+            }
+          });
+        } else if (contentType.includes('multipart/form-data')) {
+          // Multipart is NOT captured
+          span.setAttribute('http.request.body', '[MULTIPART - NOT CAPTURED]');
+          span.setAttribute('http.request.body.type', 'multipart');
+          span.setAttribute('http.request.body.note', 'File uploads not captured by design');
+        }
+      }
+    } catch (error) {
+      // Silently fail
+    }
+  },
+});
+
 // -------- SDK --------
 const traceExporter = new OTLPTraceExporter({ url: tracesUrl, headers });
 const sdk = new NodeSDK({
   traceExporter,
-  instrumentations: getNodeAutoInstrumentations({ ...disabledMap }),
+  instrumentations: [
+    httpInstrumentation,
+    ...getNodeAutoInstrumentations({ 
+      ...disabledMap,
+      '@opentelemetry/instrumentation-http': { enabled: false }, // We use our custom one above
+    }),
+  ],
   resource: new Resource({
     [SemanticResourceAttributes.SERVICE_NAME]: serviceName,
     [SemanticResourceAttributes.SERVICE_INSTANCE_ID]: serviceInstanceId,
@@ -115,6 +265,9 @@ const sdk = new NodeSDK({
   try {
     await Promise.resolve(sdk.start?.());
     console.log('[securenow] OTel SDK started → %s', tracesUrl);
+    if (captureBody) {
+      console.log('[securenow] 📝 Request body capture: ENABLED (max: %d bytes, redacting %d sensitive fields)', maxBodySize, allSensitiveFields.length);
+    }
     if (String(env('SECURENOW_TEST_SPAN')) === '1') {
       const api = require('@opentelemetry/api');
       const tracer = api.trace.getTracer('securenow-smoke');