feat: Support for IAST restrictions to scan

lib/instrumentation-security/core/request-manager.js

@@ -4,6 +4,10 @@
  */
 
 const requestMap = new Map();
+const API = require("../../nr-security-api");
+const NRAgent = API.getNRAgent();
+const logger = API.getLogger();
+const regexPatterns = NRAgent && NRAgent.config.security.exclude_from_iast_scan.api
 
 /**
  * Utility to get request by transaction Id
@@ -20,7 +24,32 @@ function getRequestFromId(id) {
  * @param {*} requestData 
  */
 function setRequest(id, requestData) {
+    if (API.getSecAgent().status.getStatus() != 'active') {
+        return;
+    }
     requestMap.set(id, requestData);
+    try {
+        const stringToMatch = requestData.url;
+        const filteredString = stringToMatch.split('?')[0];
+        let isRegexMatchestoURL = false;
+        for (let index = 0; index < regexPatterns.length; index++) {
+            const regex = new RegExp(regexPatterns[index], 'gm');
+            const matchResult = filteredString.match(regex);
+            if (matchResult && matchResult.length > 0) {
+                const data = matchResult[0];
+                if (filteredString === data) {
+                    isRegexMatchestoURL = true;
+                }
+            }
+        }
+        if (isRegexMatchestoURL) {
+            requestMap.delete(id);
+            logger.debug("Excluding URL %s from IAST processing due to ignore API setting", filteredString);
+        }
+    } catch (error) {
+        logger.debug("Error while processing API regex for restriction", error);
+    }
+
 }
 
 /**

lib/instrumentation-security/hooks/express/nr-express.js

@@ -31,8 +31,11 @@ module.exports = function initialize(shim, express) {
   if (express.Router.use) {
     wrapExpress4(shim, express)
   } 
-  expressFileHook(shim, express && express.response, 'download')
-  expressFileHook(shim, express && express.response, 'sendFile')
+  if(API && API.getNRAgent() && !API.getNRAgent().config.security.exclude_from_iast_scan.iast_detection_category.invalid_file_access){
+    expressFileHook(shim, express && express.response, 'download')
+    expressFileHook(shim, express && express.response, 'sendFile')
+  }
+
 }
 
 /**

lib/instrumentation-security/hooks/fs/nr-fs.js

@@ -94,8 +94,10 @@ const promiseFunctionProbableToFI = [
  * @param {*} moduleName 
  */
 function initialize(shim, mod, moduleName) {
-
-
+  if(API && API.getNRAgent() && API.getNRAgent().config.security.exclude_from_iast_scan.iast_detection_category.invalid_file_access){
+    logger.warn('invalid_file_access detection is disabled');
+    return;
+  }
   logger.info(`Instrumenting ${moduleName}`);
   requireHook.initialize(shim)
   const binding = process.binding("fs");

lib/instrumentation-security/hooks/http/nr-http.js

@@ -92,6 +92,10 @@ function setupRequestMapCleanup() {
  * @param {*} moduleName 
  */
 function outboundHook(shim, mod, method, moduleName) {
+  if (API && API.getNRAgent() && API.getNRAgent().config.security.exclude_from_iast_scan.iast_detection_category.ssrf) {
+    logger.warn('ssrf detection is disabled');
+    return;
+  }
   logger.debug(`Instrumenting ${moduleName}.${method}`);
   shim.wrap(mod, method, function makeRequestWrapper(shim, fn) {
     if (!shim.isFunction(fn)) {
@@ -176,7 +180,7 @@ function parseFuzzheaders(requestData, transactionId) {
       if (additionalData.length >= 8) {
         let encryptedData = additionalData[6].trim();
         let hashVerifier = additionalData[7].trim();
-        
+
         if (lodash.isEmpty(encryptedData) || lodash.isEmpty(hashVerifier)) {
           return;
         }
@@ -292,7 +296,7 @@ function emitHook(shim, mod, moduleName) {
       const resp = arguments[2];
 
       if (arguments[0] == 'request') {
-        if (NRAgent && NRAgent.config.security.detection.rxss.enabled) {
+        if (NRAgent && !NRAgent.config.security.exclude_from_iast_scan.iast_detection_category.rxss && NRAgent.config.security.detection.rxss.enabled) {
           responseHook(resp, req, shim);
         }
 

lib/instrumentation-security/hooks/ldap/nr-ldap.js

@@ -19,6 +19,10 @@ const logger = API.getLogger();
  * @param {*} moduleName 
  */
 function initialize(shim, mod, moduleName){
+  if(API && API.getNRAgent() && API.getNRAgent().config.security.exclude_from_iast_scan.iast_detection_category.ldap_injection){
+    logger.warn('ldap_injection detection is disabled');
+    return;
+  }
   logger.info('Instrumenting '+ moduleName )
 
   if(moduleName==='ldapjs' || moduleName==='ldapts'){

lib/instrumentation-security/hooks/mongodb/nr-mongodb.js

@@ -32,6 +32,10 @@ module.exports = initialize;
  * @param {Shim} shim
  */
 function initialize(shim, mongodb, moduleName) {
+  if(API && API.getNRAgent() && API.getNRAgent().config.security.exclude_from_iast_scan.iast_detection_category.nosql_injection){
+    logger.warn('nosql_injection detection is disabled');
+    return;
+  }
   logger.info(`Instrumenting ${moduleName}`);
   if (!mongodb) {
     return;

lib/instrumentation-security/hooks/mysql/nr-mysql.js

@@ -29,6 +29,10 @@ module.exports = initialize;
  */
 function initialize(shim, mysql, moduleName) {
   modName = moduleName;
+  if(API && API.getNRAgent() && API.getNRAgent().config.security.exclude_from_iast_scan.iast_detection_category.sql_injection){
+    logger.warn('sql_injection detection is disabled');
+    return;
+  }
   logger.info("Instrumenting", moduleName);
   if (shim._moduleRoot.includes("mysql2")) {
     promiseInitialize(shim, mysql, moduleName);

lib/instrumentation-security/hooks/native/nr-childProcess.js

@@ -13,6 +13,10 @@ const { NR_CSEC_FUZZ_REQUEST_ID } = require('../../core/constants');
 const logger = API.getLogger();
 
 function initialize(shim, childProcess, moduleName) {
+  if(API && API.getNRAgent() &&  API.getNRAgent().config.security.exclude_from_iast_scan.iast_detection_category.command_injection){
+    logger.warn('command_injection detection is disabled');
+    return;
+  }
   logger.info('Instrumenting child_process');
   execFileHook(shim, childProcess, moduleName);
   spawnHook(shim, childProcess, moduleName);

lib/instrumentation-security/hooks/postgres/nr-postgres.js

@@ -15,6 +15,10 @@ const logger = API.getLogger();
 const { NR_CSEC_FUZZ_REQUEST_ID } = require('../../core/constants');
 
 module.exports = function initialize(shim, pgsql, moduleName) {
+  if(API && API.getNRAgent() && API.getNRAgent().config.security.exclude_from_iast_scan.iast_detection_category.sql_injection){
+    logger.warn('sql_injection detection is disabled');
+    return;
+  }
   logger.info('Instrumenting '+ moduleName)
   // allows for native wrapping to not happen if not necessary
   // when env var is true

lib/instrumentation-security/hooks/undici/nr-undici.js

@@ -24,6 +24,10 @@ const url = require('url');
  * @param {*} moduleName 
  */
 function initialize(shim, mod, moduleName) {
+  if(API && API.getNRAgent() && API.getNRAgent().config.security.exclude_from_iast_scan.iast_detection_category.ssrf){
+    logger.warn('ssrf detection is disabled');
+    return;
+  }
   logger.info('Instrumenting ' + moduleName);
   fetchHook(shim, mod, "fetch");
   let util = shim.require('./lib/core/util');

lib/instrumentation-security/hooks/xpath/nr-xpath.js

@@ -19,6 +19,10 @@ const logger = API.getLogger();
  * @param {*} moduleName 
  */
 function initialize(shim, mod, moduleName){
+  if(API && API.getNRAgent() && API.getNRAgent().config.security.exclude_from_iast_scan.iast_detection_category.xpath_injection){
+    logger.warn('xpath_injection detection is disabled');
+    return;
+  }
  logger.info('Instrumenting '+ moduleName)
 
   if(moduleName==='xpath'){

lib/nr-security-agent/index.js

@@ -17,7 +17,7 @@ const njsAgentConstants = require('./lib/core/sec-agent-constants');
 const NRLogger = API.newrelic.shim.logger.child({ component: 'security-agent' });
 NRLogger.info("Starting New Relic Node.js Security Agent ");
 try {
-    if (NRAgent.config.security.enabled){
+    if (NRAgent.config.security.enabled) {
         require('../instrumentation-security');
     }
 } catch (error) {
@@ -117,11 +117,48 @@ function initialize() {
     if (NRAgent) {
         NRAgent.on('started', () => {
             NRLogger.info("Started New Relic Node.js Security Agent");
+            logger.info('NR Agent started with agent_run_id:', NRAgent.config.run_id, NRAgent.config.account_id);
+            if (Agent.getAgent().status.getStatus() != 'connecting') {
+                Agent.getAgent().delayed = false;
+                wsClient.obeyReconnect();
+                return;
+            }
             if (NRAgent.config.security.enabled || !NRAgent.config.high_security) {
-                wsClient.initialize();
-                logger.info('NR Agent started with agent_run_id:', NRAgent.config.run_id, NRAgent.config.account_id);
-                Agent.getAgent().status.setStatus('connecting');
-                Agent.setNRAgent(NRAgent);
+                let delayFromConfig = parseInt(NRAgent.config.security.scan_schedule.delay);
+                let delay = delayFromConfig;
+                if (isNaN(delay) || delay < 0) {
+                    delay = 0;
+                }
+                NRAgent.config.security.scan_schedule.delay = delay;
+                const allowSampling = NRAgent.config.security.scan_schedule.always_sample_traces;
+
+                if (delay > 0) {
+                    logger.debug("IAST delay is set to:", delay);
+                    logger.info("Security Agent delay scan time is set to:", commonUtils.getScheduledScanTime(delay))
+                    Agent.getAgent().delayed = true;
+                    setTimeout(() => {
+                        Agent.getAgent().delayed = false;
+                        logger.info("IAST scanning delay of %s minutes over", delay);
+                        commonUtils.executeCronSchedule();
+                        commonUtils.honourDurationConfiguration();
+                    }, delay * 60000);
+                }
+                logger.info("Security Agent is running with config:", JSON.stringify(NRAgent.config.security));
+                if (allowSampling) {
+                    wsClient.initialize();
+                    Agent.getAgent().status.setStatus('connecting');
+                    Agent.setNRAgent(NRAgent);
+                }
+                setTimeout(() => {
+                    if (commonUtils.honourCronExpression() && !allowSampling) {
+                        return;
+                    }
+                    if (!allowSampling) {
+                        wsClient.initialize();
+                        Agent.getAgent().status.setStatus('connecting');
+                        Agent.setNRAgent(NRAgent);
+                    }
+                }, delay * 60000);
             }
             else {
                 logger.warn("security.enabled flag is set to false");

lib/nr-security-agent/lib/core/Auth-headers.js

@@ -37,6 +37,7 @@ function AuthHeaders() {
         authHeaders["NR-CSEC-IAST-DATA-TRANSFER-MODE"] = "PULL";
         authHeaders['NR-CSEC-ENTITY-NAME'] = metadata['entity.name'] ? metadata['entity.name'] : '';
         authHeaders['NR-CSEC-ENTITY-GUID'] = metadata['entity.guid'] ? metadata['entity.guid'] : '';
+        authHeaders['NR-CSEC-IGNORED-VUL-CATEGORIES']  = commonUtils.listSkipDetectionCategory();
     } catch (error) {
         logger.error("Exception in preparing auth headers:", error);
         const logMessage = new LogMessage.logMessage("SEVERE", 'Exception in preparing auth headers', __filename, error);
@@ -76,6 +77,8 @@ function getInstance() {
     return authHeaders;
 }
 
+
+
 module.exports = {
     getInstance
 };

lib/nr-security-agent/lib/core/agent.js

@@ -42,6 +42,7 @@ function Agent(applicationInfo, logger, client, status) {
     this.logger = logger;
     this.status = status;
     this.wsStatus = 0;
+    this.delayed = false;
 }
 
 Agent.prototype = {};
@@ -96,6 +97,7 @@ Agent.prototype.setAgentStatus = function setAgentStatus(status) {
     Agent.eventEmitter.emit(EVENTS.AGENT_STATUS_UPDATED_EVENT, status);
 };
 
+
 Agent.EVENTS = EVENTS;
 
 Agent.eventEmitter = new EventEmitter();
@@ -138,6 +140,7 @@ Agent.setNRAgent = function setNRAgent(agent) {
     }
 };
 
+
 module.exports = {
     Agent
 };