securenow 8.23.0 → 8.24.0

package/request-capture.js

@@ -0,0 +1,487 @@
+'use strict';
+
+/**
+ * Request capture shared by every SecureNow HTTP integration: the Node preload
+ * (tracing.js), Next.js (nextjs.js) and Nuxt (through the preload). Detection rules
+ * read the same attributes whatever the framework: http.request.headers (redacted)
+ * and http.request.body (redacted, size-capped, multipart as metadata only).
+ *
+ * The body is observed, never consumed: the request's own emit('data') is wrapped,
+ * so the application reads its body exactly as it would without SecureNow.
+ */
+
+const { OTP_SENSITIVE_FIELDS, isOtpCodeField, matchesSensitiveField, redactOtpGraphQL, redactOtpQuery } = require('./otp-redaction');
+const { createHeaderNameRedactor } = require('./header-redaction');
+
+// Default sensitive fields to redact from request bodies.
+// OTP/code aliases use exact normalized matching; other fields are matched
+// substring-wise against lowercased keys (see redactSensitiveData),
+// so e.g. 'card' also catches 'creditCard' and 'account' also catches
+// 'accountNumber'. Over-redaction here is intentional: a falsely-redacted
+// telemetry value is always safer than a leaked secret. Entries are kept
+// specific enough to avoid nuking broad benign keys (e.g. we use
+// 'firstname'/'lastname'/'fullname', never bare 'name').
+const DEFAULT_SENSITIVE_FIELDS = [
+  ...OTP_SENSITIVE_FIELDS,
+  // credentials / auth
+  'password', 'passwd', 'pwd', 'secret', 'token', 'api_key', 'apikey',
+  'access_token', 'auth', 'authorization', 'bearer', 'credentials',
+  'mysql_pwd', 'otp', 'mfa', 'totp', 'sessionid', 'session_id',
+  'cookie', 'set-cookie',
+  // financial
+  'stripeToken', 'card', 'cardnumber', 'ccv', 'cvc', 'cvv',
+  'iban', 'account', 'accountnumber', 'routing', 'sortcode', 'taxid',
+  // PII
+  'ssn', 'pin', 'email', 'e_mail', 'phone', 'mobile', 'dob', 'birthdate',
+  'firstname', 'lastname', 'fullname', 'address', 'postcode', 'zip',
+  'passport', 'license',
+];
+
+// Conservative value-shape redactors. Key-name matching misses secrets that
+// land in free-form string values (GraphQL bodies, message fields, etc.), so
+// as a second layer we scrub string VALUES that *look like* a secret/PII.
+// These are intentionally precise/bounded so they don't garble normal prose,
+// and they only ever transform captured telemetry strings (read-only) — never
+// the actual request/response stream. Compiled once at module load.
+const VALUE_REDACTORS = [
+  // JWT: three base64url segments. Anchored to the eyJ header so it won't
+  // match arbitrary dotted tokens.
+  { name: 'jwt', re: /eyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}/g },
+  // Bearer/Basic auth header value embedded in a body string.
+  { name: 'bearer', re: /\b(?:Bearer|Basic)\s+[A-Za-z0-9._~+/=-]{8,}/gi },
+  // Stripe-style / SecureNow live+test API keys.
+  { name: 'apikey', re: /\b(?:sk|pk|rk|snk)_(?:live|test)_[A-Za-z0-9]{8,}/g },
+  // Email addresses (bounded local/domain parts).
+  { name: 'email', re: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,24}\b/g },
+  // Credit-card-like: 13–19 digit runs that pass a Luhn check, allowing
+  // space/dash grouping. Luhn-gated to avoid clobbering ordinary long numbers.
+  { name: 'card', re: /\b(?:\d[ -]?){13,19}\b/g, luhn: true },
+];
+
+// Skip the value-shape scan on very large strings to bound per-body cost.
+const MAX_VALUE_SCAN_LENGTH = 16384;
+
+function luhnValid(digits) {
+  let sum = 0;
+  let alt = false;
+  for (let i = digits.length - 1; i >= 0; i--) {
+    let d = digits.charCodeAt(i) - 48;
+    if (d < 0 || d > 9) return false;
+    if (alt) { d *= 2; if (d > 9) d -= 9; }
+    sum += d;
+    alt = !alt;
+  }
+  return sum % 10 === 0;
+}
+
+/**
+ * Redact obvious secret/PII shapes inside a captured string VALUE.
+ * Returns the input unchanged when nothing matches (cheap common case).
+ */
+function redactSensitiveValue(value) {
+  if (typeof value !== 'string' || value.length === 0) return value;
+  // Credential assignments in GraphQL/query strings need field-aware
+  // redaction even though a short numeric OTP has no unique value shape.
+  value = redactOtpQuery(redactOtpGraphQL(value));
+  if (value.length > MAX_VALUE_SCAN_LENGTH) return value; // bound shape scans
+  let out = value;
+  for (const r of VALUE_REDACTORS) {
+    r.re.lastIndex = 0;
+    if (r.luhn) {
+      out = out.replace(r.re, (m) => {
+        const digits = m.replace(/[ -]/g, '');
+        if (digits.length < 13 || digits.length > 19) return m;
+        return luhnValid(digits) ? '[REDACTED]' : m;
+      });
+    } else {
+      out = out.replace(r.re, '[REDACTED]');
+    }
+  }
+  return out;
+}
+
+function escapeRegex(str) {
+  return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+/**
+ * Redact sensitive fields from an object
+ */
+function redactSensitiveData(obj, sensitiveFields = DEFAULT_SENSITIVE_FIELDS) {
+  if (!obj || typeof obj !== 'object') return obj;
+
+  const redacted = Array.isArray(obj) ? [...obj] : { ...obj };
+
+  for (const key of Object.keys(redacted)) {
+
+    if (matchesSensitiveField(key, sensitiveFields)) {
+      redacted[key] = '[REDACTED]';
+    } else if (typeof redacted[key] === 'object' && redacted[key] !== null) {
+      redacted[key] = redactSensitiveData(redacted[key], sensitiveFields);
+    } else if (typeof redacted[key] === 'string') {
+      // Second layer: even if the key name looks benign, scrub values that
+      // *look like* a secret/PII (JWT, bearer token, API key, email, card).
+      redacted[key] = redactSensitiveValue(redacted[key]);
+    }
+  }
+
+  return redacted;
+}
+
+/**
+ * Redact sensitive data from GraphQL query strings
+ */
+function redactGraphQLQuery(query, sensitiveFields = DEFAULT_SENSITIVE_FIELDS) {
+  if (!query || typeof query !== 'string') return query;
+
+  let redacted = query;
+
+  // Redact sensitive fields in GraphQL arguments and variables
+  sensitiveFields.filter(field => field === 'otp' || !isOtpCodeField(field)).forEach(field => {
+    const escaped = escapeRegex(field);
+    const patterns = [
+      // Quoted values: password: "..." keeps its quotes.
+      new RegExp(`(${escaped}\\s*:\\s*["'])([^"']+)(["'])`, 'gi'),
+      // Unquoted values (variables, numbers). A value starting with a quote was handled above.
+      new RegExp(`(${escaped}\\s*:\\s*)([^\\s,})\n"'][^\\s,})\n]*)`, 'gi'),
+    ];
+
+    patterns.forEach(pattern => {
+      // With two groups the third callback argument is the match offset, not a suffix: testing
+      // it for truthiness appended the offset to the redacted value ("[REDACTED]17").
+      redacted = redacted.replace(pattern, (match, prefix, value, suffix) => (
+        typeof suffix === 'string' ? `${prefix}[REDACTED]${suffix}` : `${prefix}[REDACTED]`
+      ));
+    });
+  });
+
+  // Second layer: scrub secret/PII *shapes* anywhere in the (free-form) query
+  // body — catches values the key-name pass above can't see.
+  redacted = redactOtpGraphQL(redactSensitiveValue(redacted));
+
+  return redacted;
+}
+
+/**
+ * Redact a captured body text by content type: the same rules as the HTTP-layer capture,
+ * for integrations that only see the body as text (Next.js Request.text()).
+ */
+function redactBodyText(bodyText, contentType, sensitiveFields = DEFAULT_SENSITIVE_FIELDS) {
+  const ct = String(contentType || '').toLowerCase();
+  if (ct.includes('application/graphql')) {
+    return { body: redactGraphQLQuery(bodyText, sensitiveFields), type: 'graphql' };
+  }
+  if (ct.includes('application/json')) {
+    return { body: JSON.stringify(redactSensitiveData(JSON.parse(bodyText), sensitiveFields)), type: 'json' };
+  }
+  if (ct.includes('application/x-www-form-urlencoded')) {
+    return { body: JSON.stringify(redactSensitiveData(Object.fromEntries(new URLSearchParams(bodyText)), sensitiveFields)), type: 'form' };
+  }
+  return null;
+}
+
+// -------- Multipart streaming parser --------
+// Streams through the request without buffering file content.
+// Only part headers and text-field values are kept in memory,
+// so memory stays bounded (~few KB) regardless of upload size.
+
+function extractBoundary(contentType) {
+  const match = contentType.match(/boundary=(?:"([^"]+)"|([^\s;]+))/i);
+  return match ? (match[1] || match[2]) : null;
+}
+
+function createMultipartMetaCollector(contentType, sensitiveFields, maxTextFieldSize, onComplete) {
+  const boundary = extractBoundary(contentType);
+  if (!boundary) { onComplete({ error: 'BOUNDARY_NOT_FOUND' }); return null; }
+
+  const result = { fields: Object.create(null), files: [] };
+  let totalSize = 0;
+  let buf = Buffer.alloc(0);
+
+  const MAX_PARTS = 100;
+  let partCount = 0;
+
+  const FIRST_DELIM = Buffer.from('--' + boundary);
+  const DELIM       = Buffer.from('\r\n--' + boundary);
+  const HDR_END     = Buffer.from('\r\n\r\n');
+
+  let initialized = false;
+  let inHeaders = true;
+  let isFile = false;
+  let fldName = '';
+  let fName = '';
+  let pCT = '';
+  let bodyBytes = 0;
+  let textVal = '';
+
+  function flushPart() {
+    if (!fldName || fldName === '__proto__' || fldName === 'constructor' || fldName === 'prototype') return;
+    if (isFile) {
+      result.files.push({ field: fldName, filename: fName, contentType: pCT || 'unknown', size: bodyBytes });
+    } else {
+      const redact = matchesSensitiveField(fldName, sensitiveFields);
+      // Name-match redaction first; otherwise scrub secret/PII *shapes* in the value.
+      result.fields[fldName] = redact
+        ? '[REDACTED]'
+        : redactSensitiveValue(textVal.substring(0, maxTextFieldSize));
+    }
+    fldName = ''; bodyBytes = 0; textVal = ''; partCount++;
+  }
+
+  function drain() {
+    if (!initialized) {
+      const i = buf.indexOf(FIRST_DELIM);
+      if (i === -1) {
+        if (buf.length > FIRST_DELIM.length + 4) buf = buf.slice(buf.length - FIRST_DELIM.length - 4);
+        return;
+      }
+      buf = buf.slice(i + FIRST_DELIM.length);
+      initialized = true;
+      inHeaders = true;
+    }
+
+    let guard = 200;
+    while (buf.length > 0 && guard-- > 0 && partCount < MAX_PARTS) {
+      if (inHeaders) {
+        if (buf.length >= 2 && buf[0] === 0x2D && buf[1] === 0x2D) { buf = Buffer.alloc(0); return; }
+        if (buf.length >= 2 && buf[0] === 0x0D && buf[1] === 0x0A) { buf = buf.slice(2); continue; }
+
+        const hi = buf.indexOf(HDR_END);
+        if (hi === -1) return;
+
+        const hdr = buf.slice(0, hi).toString('latin1');
+        buf = buf.slice(hi + 4);
+
+        const nm = hdr.match(/name="([^"]+)"/);
+        const fn = hdr.match(/filename="([^"]*)"/);
+        const ct = hdr.match(/Content-Type:\s*(.+)/i);
+        fldName = nm ? nm[1] : '';
+        fName   = fn ? fn[1] : '';
+        pCT     = ct ? ct[1].trim() : '';
+        isFile  = !!fn;
+        bodyBytes = 0;
+        textVal = '';
+        inHeaders = false;
+      }
+
+      const di = buf.indexOf(DELIM);
+      if (di === -1) {
+        const safe = Math.max(0, buf.length - DELIM.length - 2);
+        if (safe > 0) {
+          bodyBytes += safe;
+          if (!isFile && textVal.length < maxTextFieldSize) {
+            textVal += buf.slice(0, safe).toString('utf8').substring(0, maxTextFieldSize - textVal.length);
+          }
+          buf = buf.slice(safe);
+        }
+        return;
+      }
+
+      bodyBytes += di;
+      if (!isFile && textVal.length < maxTextFieldSize) {
+        textVal += buf.slice(0, di).toString('utf8').substring(0, maxTextFieldSize - textVal.length);
+      }
+      flushPart();
+      buf = buf.slice(di + DELIM.length);
+      inHeaders = true;
+    }
+  }
+
+  function onData(chunk) {
+    const data = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    totalSize += data.length;
+    buf = Buffer.concat([buf, data]);
+    drain();
+  }
+
+  function onEnd() {
+    try {
+      if (!inHeaders && fldName) {
+        bodyBytes += buf.length;
+        if (!isFile) textVal += buf.toString('utf8').substring(0, maxTextFieldSize - textVal.length);
+        flushPart();
+      }
+      onComplete({ parsed: result, totalSize });
+    } catch (e) {
+      onComplete({ error: 'PARSE_ERROR' });
+    }
+  }
+
+  return { onData, onEnd };
+}
+
+const BODY_CAPTURE_PATCH = Symbol.for('securenow.bodyCapture.emitPatch');
+
+/**
+ * @param {{ captureBody?: boolean, captureMultipart?: boolean, maxBodySize?: number, customSensitiveFields?: string[] }} options
+ */
+function createRequestCapture(options = {}) {
+  const captureBody = options.captureBody !== false;
+  const captureMultipart = options.captureMultipart !== false;
+  const maxBodySize = options.maxBodySize || 10240;
+  const customSensitiveFields = options.customSensitiveFields || [];
+  const allSensitiveFields = [...DEFAULT_SENSITIVE_FIELDS, ...customSensitiveFields];
+
+  // Credential-bearing request headers (cookies, auth, CSRF/XSRF, session, API keys, and any
+  // configured capture.sensitiveFields) are redacted by name before capture.
+  const isSensitiveHeaderName = createHeaderNameRedactor(customSensitiveFields);
+
+  function captureHeaders(span, request) {
+    if (!request || !request.headers) return;
+    const safe = {};
+    for (const [k, v] of Object.entries(request.headers)) {
+      if (isSensitiveHeaderName(k)) { safe[k] = '[REDACTED]'; continue; }
+      safe[k] = redactSensitiveValue(redactOtpQuery(typeof v === 'string' ? v : String(v))).substring(0, 500);
+    }
+    const serialized = JSON.stringify(safe);
+    if (serialized.length <= 8192) {
+      span.setAttribute('http.request.headers', serialized);
+    }
+  }
+
+  function installRequestBodyObserver(span, request, contentType) {
+    if (!request || request[BODY_CAPTURE_PATCH]) return;
+
+    const normalizedContentType = String(contentType || '').toLowerCase();
+    const isStructuredBody = captureBody && (
+      normalizedContentType.includes('application/json') ||
+      normalizedContentType.includes('application/graphql') ||
+      normalizedContentType.includes('application/x-www-form-urlencoded')
+    );
+    const isMultipartBody = normalizedContentType.includes('multipart/form-data');
+
+    if (!isStructuredBody && !isMultipartBody) return;
+
+    if (isMultipartBody && !captureMultipart) {
+      span.setAttribute('http.request.body', '[MULTIPART - NOT CAPTURED]');
+      span.setAttribute('http.request.body.type', 'multipart');
+      span.setAttribute('http.request.body.note', 'Multipart capture disabled by config.capture.multipart=false');
+      return;
+    }
+
+    let chunks = [];
+    let size = 0;
+    let structuredDone = false;
+
+    // The boundary is case-sensitive: browsers send mixed-case ones (----WebKitFormBoundaryAbC...),
+    // so it is read from the header as sent, not from the lowercased copy (which found no part).
+    const multipartCollector = isMultipartBody && captureMultipart
+      ? createMultipartMetaCollector(String(contentType || ''), allSensitiveFields, 1000, ({ error, parsed, totalSize }) => {
+          try {
+            if (error === 'BOUNDARY_NOT_FOUND') {
+              span.setAttribute('http.request.body', '[MULTIPART - BOUNDARY NOT FOUND]');
+              span.setAttribute('http.request.body.type', 'multipart');
+              return;
+            }
+            if (error) {
+              span.setAttribute('http.request.body', '[MULTIPART - PARSE ERROR]');
+              span.setAttribute('http.request.body.type', 'multipart');
+              span.setAttribute('http.request.body.parse_error', true);
+              return;
+            }
+            span.setAttributes({
+              'http.request.body': JSON.stringify(parsed).substring(0, maxBodySize),
+              'http.request.body.type': 'multipart',
+              'http.request.body.size': totalSize,
+              'http.request.body.fields_count': Object.keys(parsed.fields).length,
+              'http.request.body.files_count': parsed.files.length,
+            });
+          } catch (e) {
+            span.setAttribute('http.request.body', '[MULTIPART - PARSE ERROR]');
+            span.setAttribute('http.request.body.type', 'multipart');
+            span.setAttribute('http.request.body.parse_error', true);
+          }
+        })
+      : null;
+
+    if (isMultipartBody && captureMultipart && !multipartCollector) return;
+
+    function finishStructuredCapture() {
+      if (!isStructuredBody || structuredDone) return;
+      structuredDone = true;
+
+      if (size > maxBodySize) {
+        span.setAttribute('http.request.body', `[TOO LARGE: ${size} bytes]`);
+        span.setAttribute('http.request.body.size', size);
+        chunks = [];
+        return;
+      }
+
+      if (chunks.length === 0) return;
+
+      const body = Buffer.concat(chunks).toString('utf8');
+      chunks = [];
+
+      try {
+        if (normalizedContentType.includes('application/graphql')) {
+          const redacted = redactGraphQLQuery(body, allSensitiveFields);
+          span.setAttributes({
+            'http.request.body': redacted.substring(0, maxBodySize),
+            'http.request.body.type': 'graphql',
+            'http.request.body.size': size,
+          });
+        } else if (normalizedContentType.includes('application/json')) {
+          const parsed = JSON.parse(body);
+          const redacted = redactSensitiveData(parsed, allSensitiveFields);
+          span.setAttributes({
+            'http.request.body': JSON.stringify(redacted).substring(0, maxBodySize),
+            'http.request.body.type': 'json',
+            'http.request.body.size': size,
+          });
+        } else if (normalizedContentType.includes('application/x-www-form-urlencoded')) {
+          const parsed = Object.fromEntries(new URLSearchParams(body));
+          const redacted = redactSensitiveData(parsed, allSensitiveFields);
+          span.setAttributes({
+            'http.request.body': JSON.stringify(redacted).substring(0, maxBodySize),
+            'http.request.body.type': 'form',
+            'http.request.body.size': size,
+          });
+        }
+      } catch (e) {
+        span.setAttribute('http.request.body', '[UNPARSEABLE - REDACTED FOR SAFETY]');
+        span.setAttribute('http.request.body.parse_error', true);
+        span.setAttribute('http.request.body.size', size);
+      }
+    }
+
+    const originalEmit = request.emit;
+    request[BODY_CAPTURE_PATCH] = true;
+    request.emit = function securenowObservedEmit(event, ...args) {
+      try {
+        if (event === 'data' && args.length > 0) {
+          const chunk = Buffer.isBuffer(args[0]) ? args[0] : Buffer.from(args[0]);
+          if (isStructuredBody) {
+            size += chunk.length;
+            if (size <= maxBodySize) chunks.push(chunk);
+          }
+          if (multipartCollector) multipartCollector.onData(chunk);
+        } else if (event === 'end') {
+          finishStructuredCapture();
+          if (multipartCollector) multipartCollector.onEnd();
+        }
+      } catch (_) {
+        // Body capture must never interfere with the application request stream.
+      }
+      return originalEmit.apply(this, [event, ...args]);
+    };
+  }
+
+  function observeBody(span, request) {
+    if (!(captureBody || captureMultipart) || !request || !request.method) return;
+    if (!['POST', 'PUT', 'PATCH'].includes(request.method)) return;
+    const contentType = (request.headers && request.headers['content-type']) || '';
+    installRequestBodyObserver(span, request, contentType);
+  }
+
+  return { captureBody, captureMultipart, maxBodySize, allSensitiveFields, captureHeaders, observeBody };
+}
+
+module.exports = {
+  DEFAULT_SENSITIVE_FIELDS,
+  redactSensitiveValue,
+  redactSensitiveData,
+  redactGraphQLQuery,
+  redactBodyText,
+  createMultipartMetaCollector,
+  createRequestCapture,
+};