feat: IAST support for Undici

lib/instrumentation-security/hooks/undici/nr-undici.js

@@ -0,0 +1,139 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: New Relic Pre-Release
+ */
+
+module.exports = initialize
+const requestManager = require('../../core/request-manager');
+const secUtils = require("../../core/sec-utils");
+const API = require("../../../nr-security-api");
+const lodash = require('lodash');
+const securityMetaData = require('../../core/security-metadata');
+const { EVENT_TYPE, EVENT_CATEGORY } = require('../../core/event-constants');
+const { NR_CSEC_FUZZ_REQUEST_ID, QUESTION_MARK, EMPTY_STRING, COLON, SLASH } = require('../../core/constants');
+const NRCSECTRACINGDATA = 'NR-CSEC-TRACING-DATA';
+const DOUBLE_SLASH = '//';
+const logger = API.getLogger();
+const url = require('url');
+
+
+/**
+ * Entry point undici module instrumentation.
+ * @param {*} shim 
+ * @param {*} mod 
+ * @param {*} moduleName 
+ */
+function initialize(shim, mod, moduleName) {
+  logger.info('Instrumenting ' + moduleName);
+  fetchHook(shim, mod, "fetch");
+  let util = shim.require('./lib/core/util');
+  parseOriginHook(shim, util, "parseOrigin")
+
+}
+/**
+ * Wrapper for util.parseOrigin
+ * @param {*} shim 
+ * @param {*} mod 
+ * @param {*} methodName 
+ */
+function parseOriginHook(shim, mod, methodName) {
+  shim.wrap(mod, methodName, function ClientWrapper(shim, fn) {
+    logger.debug(`Instrumenting ${methodName}`);
+    if (!shim.isFunction(fn)) {
+      return fn
+    }
+    return function wrapper() {
+      const request = requestManager.getRequest(shim);
+      try {
+        if (typeof arguments[0] === 'string') {
+          let URLObject = new URL(arguments[0]);
+          const data = {};
+          data.headers = {};
+          data.path = URLObject.pathname ? URLObject.pathname : EMPTY_STRING;
+          data.protocol = URLObject.protocol ? URLObject.protocol : 'http:';
+          data.headers.host = URLObject.host ? URLObject.host : URLObject.hostname;
+          shim.interceptedArgs = data;
+          if (request) {
+            const traceObject = secUtils.getTraceObject(shim);
+            const secMetadata = securityMetaData.getSecurityMetaData(request, data, traceObject, secUtils.getExecutionId(), EVENT_TYPE.HTTP_REQUEST, EVENT_CATEGORY.HTTP)
+            this.secEvent = API.generateSecEvent(secMetadata);
+            API.sendEvent(this.secEvent);
+          }
+        }
+      } catch (error) {
+
+      }
+      const result = fn.apply(this, arguments);
+      if (result && request && request.headers[NR_CSEC_FUZZ_REQUEST_ID]) {
+        API.generateExitEvent(this.secEvent);
+        delete this.secEvent
+      }
+      return result;
+    }
+  })
+}
+
+/**
+ * Wrapper to hook undici.fetch()
+ * @param {*} shim 
+ * @param {*} mod 
+ * @param {*} methodName 
+ */
+function fetchHook(shim, mod, methodName) {
+  shim.wrap(mod, methodName, function makeWrapper(shim, fn) {
+    logger.debug(`Instrumenting ${methodName}`);
+    if (!shim.isFunction(fn)) {
+      return fn
+    }
+    return function wrapper() {
+      const request = requestManager.getRequest(shim);
+      try {
+        const completeURL = arguments[0];
+        const parsedUrl = url.parse(completeURL);
+        const data = {};
+        data.headers = {};
+        data.method = arguments[0].method ? arguments[0].method : EMPTY_STRING;
+        data.path = parsedUrl.pathname ? parsedUrl.pathname : parsedUrl.path;
+        data.protocol = parsedUrl.protocol;
+        data.headers.host = parsedUrl.host ? parsedUrl.host : parsedUrl.hostname;
+        data.port = parsedUrl.port ? parsedUrl.port : parsedUrl.port;
+
+        shim.interceptedArgs = data;
+        if (request && !lodash.isEmpty(data.headers.host) && !lodash.isEmpty(data.path)) {
+          const appUUID = API.getSecAgent().applicationInfo.applicationUUID;
+          const traceObject = secUtils.getTraceObject(shim);
+          const secMetadata = securityMetaData.getSecurityMetaData(request, data, traceObject, secUtils.getExecutionId(), EVENT_TYPE.HTTP_REQUEST, EVENT_CATEGORY.HTTP)
+          this.secEvent = API.generateSecEvent(secMetadata);
+          API.sendEvent(this.secEvent);
+
+          let traceHeader = EMPTY_STRING;
+          if (request.headers['nr-csec-tracing-data']) {
+            traceHeader = request.headers['nr-csec-tracing-data'];
+          }
+
+          if (arguments[1] instanceof Object) {
+            if (arguments[1] && arguments[1].headers && request.headers) {
+              arguments[1].headers[NRCSECTRACINGDATA] = traceHeader + appUUID + '/' + this.secEvent.apiId + '/' + this.secEvent.id + ';';
+            } else {
+              arguments[1].headers = {};
+              arguments[1].headers[NRCSECTRACINGDATA] = traceHeader + appUUID + '/' + this.secEvent.apiId + '/' + this.secEvent.id + ';';
+            }
+            if (request && request.headers[NR_CSEC_FUZZ_REQUEST_ID] && arguments[1].headers) {
+              arguments[1].headers[NR_CSEC_FUZZ_REQUEST_ID] = request.headers[NR_CSEC_FUZZ_REQUEST_ID];
+            }
+          }
+        }
+      } catch (error) {
+        logger.debug("Error while extracting undici fetch args:", error);
+      }
+      const result = fn.apply(this, arguments);
+
+      if (result && request && request.headers[NR_CSEC_FUZZ_REQUEST_ID]) {
+        API.generateExitEvent(this.secEvent);
+        delete this.secEvent
+      }
+      return result;
+    }
+  })
+}
+

lib/instrumentation-security/index.js

@@ -190,6 +190,15 @@ newrelic.instrumentWebframework({
   }
 })
 
+newrelic.instrumentWebframework({
+  moduleName: 'undici',
+  isEsm: true,
+  onRequire: require('./hooks/undici/nr-undici'),
+  onError: function intrumentErrorHandler(err) {
+    logger.error(err.message, err.stack)
+  }
+})
+
 
 
 

package.json

@@ -19,7 +19,8 @@
   "scripts": {
     "test": "tap --test-regex='(\\/|^test\\/instrumentation-security\\/.*\\.test\\.js)$' --no-coverage",
     "posttest": "rm -f newrelic_agent.log && rm -rf nr-security-home && rm -rf .nyc_output",
-    "third-party-updates": "oss third-party manifest && oss third-party notices && git add THIRD_PARTY_NOTICES.md third_party_manifest.json"
+    "third-party-updates": "oss third-party manifest && oss third-party notices && git add THIRD_PARTY_NOTICES.md third_party_manifest.json",
+    "undici": "tap test/instrumentation-security/nr-undici.test.js"
   },
   "keywords": [
     "instrumentation",
@@ -84,7 +85,9 @@
     "request": "^2.88.2",
     "restify": "^11.1.0",
     "sinon": "^15.0.0",
+    "stream": "^0.0.2",
     "tap": "^16.3.2",
+    "undici": "^5.28.0",
     "xmldom": "^0.6.0",
     "xpath": "^0.0.32",
     "xpath.js": "^1.1.0"