Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature to send HTTP Response for Reported Vulnerabilities #343

Open
wants to merge 11 commits into
base: main
Choose a base branch
from
Open

Feature to send HTTP Response for Reported Vulnerabilities #343

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
70acca1
Add Transaction start and finish listeners
lovesh-ap Oct 4, 2024
7f46937
Merge branch 'refs/heads/fix/trace-id-reporting/NR-321827' into featu…
lovesh-ap Oct 16, 2024
53561c7
implementation for the feature to send http response for vulnerabilities
lovesh-ap Oct 17, 2024
3239c17
Functionality to never disable http response hooks, disable event gen…
lovesh-ap Oct 24, 2024
4998e08
Rename field value iastRequest to isIASTRequest
lovesh-ap Oct 25, 2024
f2b0c71
Trim response body to 500KB if more
lovesh-ap Nov 14, 2024
cac35d4
trim response body for RXSS and change json name for http response event
lovesh-ap Nov 16, 2024
10692ed
Updating isEmpty condition in HttpResponseEvent
IshikaDawda Dec 5, 2024
c20e8bb
Merge branch 'refs/heads/main' into feature/include-http-response
IshikaDawda Jan 15, 2025
80edf6a
Update invokes of HttpResponse methods
IshikaDawda Jan 15, 2025
3d16620
Merge branch 'refs/heads/main' into feature/include-http-response
lovesh-ap Feb 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion gradle.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# The agent version.
agentVersion=1.6.0
jsonVersion=1.2.9
jsonVersion=1.2.10
# Updated exposed NR APM API version.
nrAPIVersion=8.12.0

Expand Down
6 changes: 5 additions & 1 deletion ...security/akka-http-2.11_10.0.0/src/main/scala/akka/http/scaladsl/AkkaResponseHelper.scala
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,8 @@ import com.newrelic.api.agent.security.schema.exceptions.NewRelicSecurityExcepti
import com.newrelic.api.agent.security.utils.logging.LogLevel

import java.lang
import java.util.{HashMap => JavaHashMap}
import scala.concurrent.{ExecutionContext, Future}
import scala.runtime.AbstractFunction1

class AkkaResponseHelper extends AbstractFunction1[HttpResponse, HttpResponse] {
Expand All @@ -25,7 +27,9 @@ class AkkaResponseHelper extends AbstractFunction1[HttpResponse, HttpResponse] {
val stringResponse = new lang.StringBuilder()
val isLockAquired = GenericHelper.acquireLockIfPossible(AkkaCoreUtils.NR_SEC_CUSTOM_ATTRIB_NAME);
stringResponse.append(httpResponse.entity.asInstanceOf[HttpEntity.Strict].getData().decodeString("utf-8"))
AkkaCoreUtils.postProcessHttpRequest(isLockAquired, stringResponse, httpResponse.entity.contentType.toString(), this.getClass.getName, "apply", NewRelic.getAgent.getTransaction.getToken())
val headers = new JavaHashMap[String, String]()
httpResponse.headers.foreach(header => headers.put(header.name(), header.value()))
AkkaCoreUtils.postProcessHttpRequest(isLockAquired, stringResponse, httpResponse.entity.contentType.toString(), headers, httpResponse.status.intValue(), this.getClass.getName, "apply", NewRelic.getAgent.getTransaction.getToken())
} catch {
case t: NewRelicSecurityException =>
NewRelicSecurity.getAgent.log(LogLevel.WARNING, String.format(GenericHelper.SECURITY_EXCEPTION_MESSAGE, AkkaCoreUtils.AKKA_HTTP_10_0_0, t.getMessage), t, classOf[AkkaCoreUtils].getName)
Expand Down
15 changes: 8 additions & 7 deletions ...ecurity/akka-http-2.11_10.0.0/src/main/scala/akka/http/scaladsl/server/AkkaCoreUtils.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@
import com.newrelic.api.agent.security.schema.policy.AgentPolicy;
import com.newrelic.api.agent.security.utils.logging.LogLevel;

import java.util.HashMap;
import java.util.Iterator;
import java.util.Map;
import java.util.NoSuchElementException;
Expand All @@ -33,18 +34,18 @@ public static boolean acquireServletLockIfPossible() {
return GenericHelper.acquireLockIfPossible(VulnerabilityCaseType.REFLECTED_XSS, NR_SEC_CUSTOM_ATTRIB_NAME);
}

public static void postProcessHttpRequest(Boolean isServletLockAcquired, StringBuilder responseBody, String contentType, String className, String methodName, Token token) {
if(NewRelicSecurity.getAgent().getIastDetectionCategory().getRxssEnabled()){
return;
}
public static void postProcessHttpRequest(Boolean isServletLockAcquired, StringBuilder responseBody, String contentType, HashMap<String, String> headers, int responseCode, String className, String methodName, Token token) {
try {
token.linkAndExpire();
ServletHelper.executeBeforeExitingTransaction();
// ServletHelper.executeBeforeExitingTransaction();
if(!isServletLockAcquired || !NewRelicSecurity.isHookProcessingActive() || Boolean.TRUE.equals(NewRelicSecurity.getAgent().getSecurityMetaData().getCustomAttribute("RXSS_PROCESSED", Boolean.class))){
return;
}
NewRelicSecurity.getAgent().getSecurityMetaData().getResponse().setResponseContentType(contentType);
NewRelicSecurity.getAgent().getSecurityMetaData().getResponse().setResponseBody(responseBody);
NewRelicSecurity.getAgent().getSecurityMetaData().getResponse().setContentType(contentType);
NewRelicSecurity.getAgent().getSecurityMetaData().getResponse().setHeaders(headers);
NewRelicSecurity.getAgent().getSecurityMetaData().getResponse().setBody(responseBody);
NewRelicSecurity.getAgent().getSecurityMetaData().getResponse().setStatusCode(responseCode);

LowSeverityHelper.addRrequestUriToEventFilter(NewRelicSecurity.getAgent().getSecurityMetaData().getRequest());

RXSSOperation rxssOperation = new RXSSOperation(NewRelicSecurity.getAgent().getSecurityMetaData().getRequest(),
Expand Down
15 changes: 6 additions & 9 deletions ...ntation-security/akka-http-core-10.0/src/main/scala/akka/http/scaladsl/AkkaCoreUtils.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,21 +35,18 @@ public static boolean acquireServletLockIfPossible() {
return GenericHelper.acquireLockIfPossible(VulnerabilityCaseType.REFLECTED_XSS, NR_SEC_CUSTOM_ATTRIB_NAME);
}

public static void postProcessHttpRequest(Boolean isServletLockAcquired, StringBuilder response, String contentType, int responseCode, String className, String methodName, Token token) {
public static void postProcessHttpRequest(Boolean isServletLockAcquired, StringBuilder response, String contentType, HashMap<String, String> headers, int responseCode, String className, String methodName, Token token) {
try {
if(NewRelicSecurity.getAgent().getIastDetectionCategory().getRxssEnabled()){
return;
}
token.linkAndExpire();

if(!isServletLockAcquired || !NewRelicSecurity.isHookProcessingActive()){
return;
}
NewRelicSecurity.getAgent().getSecurityMetaData().getResponse().setResponseContentType(contentType);
NewRelicSecurity.getAgent().getSecurityMetaData().getResponse().setResponseBody(response);
NewRelicSecurity.getAgent().getSecurityMetaData().getResponse().setResponseCode(responseCode);
ServletHelper.executeBeforeExitingTransaction();

NewRelicSecurity.getAgent().getSecurityMetaData().getResponse().setContentType(contentType);
NewRelicSecurity.getAgent().getSecurityMetaData().getResponse().setHeaders(headers);
NewRelicSecurity.getAgent().getSecurityMetaData().getResponse().setBody(response);
NewRelicSecurity.getAgent().getSecurityMetaData().getResponse().setStatusCode(responseCode);
// ServletHelper.executeBeforeExitingTransaction();
LowSeverityHelper.addRrequestUriToEventFilter(NewRelicSecurity.getAgent().getSecurityMetaData().getRequest());

if(!ServletHelper.isResponseContentTypeExcluded(NewRelicSecurity.getAgent().getSecurityMetaData().getResponse().getResponseContentType())) {
Expand Down
11 changes: 7 additions & 4 deletions ...security/akka-http-core-10.0/src/main/scala/akka/http/scaladsl/ResponseFutureHelper.scala
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,12 +15,12 @@ import akka.stream.scaladsl.Sink
import akka.util.ByteString
import com.newrelic.api.agent.security.NewRelicSecurity
import com.newrelic.api.agent.security.instrumentation.helpers.GenericHelper
import com.newrelic.api.agent.security.schema.StringUtils
import com.newrelic.api.agent.security.schema.exceptions.NewRelicSecurityException
import com.newrelic.api.agent.security.utils.logging.LogLevel
import com.newrelic.api.agent.{NewRelic, Token}

import java.lang
import java.util.{HashMap => JavaHashMap}
import scala.concurrent.{ExecutionContext, Future}

object ResponseFutureHelper {
Expand All @@ -41,7 +41,9 @@ object ResponseFutureHelper {
processingResult.onComplete {
_ => {
token.linkAndExpire()
AkkaCoreUtils.postProcessHttpRequest(isLockAquired, stringResponse, response.entity.contentType.toString(), response.status.intValue(), this.getClass.getName, "apply", NewRelic.getAgent.getTransaction.getToken)
val headers = new JavaHashMap[String, String]()
response.headers.foreach(header => headers.put(header.name(), header.value()))
AkkaCoreUtils.postProcessHttpRequest(isLockAquired, stringResponse, response.entity.contentType.toString(), headers, response.status.intValue(), this.getClass.getName, "apply", NewRelic.getAgent.getTransaction.getToken)
}
}

Expand All @@ -67,8 +69,9 @@ object ResponseFutureHelper {
stringResponse.append(chunk)
}
val processingResult: Future[Done] = dataBytes.runWith(sink, materializer)

AkkaCoreUtils.postProcessHttpRequest(isLockAquired, stringResponse, httpResponse.entity.contentType.toString(), httpResponse.status.intValue(), this.getClass.getName, "apply", NewRelic.getAgent.getTransaction.getToken())
val headers = new JavaHashMap[String, String]()
httpResponse.headers.foreach(header => headers.put(header.name(), header.value()))
AkkaCoreUtils.postProcessHttpRequest(isLockAquired, stringResponse, httpResponse.entity.contentType.toString(), headers, httpResponse.status.intValue(), this.getClass.getName, "apply", NewRelic.getAgent.getTransaction.getToken())
} catch {
case t: NewRelicSecurityException =>
NewRelicSecurity.getAgent.log(LogLevel.WARNING, String.format(GenericHelper.SECURITY_EXCEPTION_MESSAGE, AkkaCoreUtils.AKKA_HTTP_CORE_10_0, t.getMessage), t, classOf[AkkaCoreUtils].getName)
Expand Down
4 changes: 2 additions & 2 deletions ...test/scala/com/nr/agent/security/instrumentation/akka/http/core_10/AkkaHttpCoreTest.scala
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -233,15 +233,15 @@ class AkkaHttpCoreTest {

Assert.assertFalse("response should not be empty", operation.getResponse.isEmpty)
Assert.assertEquals("Invalid response content-type.", operation.getResponse.getResponseContentType, contentType)
Assert.assertEquals("Invalid responseBody.", operation.getResponse.getResponseBody.toString, responseBody)
Assert.assertEquals("Invalid responseBody.", operation.getResponse.getBody.toString, responseBody)
}
private def assertMetaData(metaData: SecurityMetaData): Unit = {
Assert.assertFalse("response should not be empty", metaData.getResponse.isEmpty)
Assert.assertEquals("Invalid response content-type.", metaData.getRequest.getContentType, contentType)
Assert.assertEquals("Invalid responseBody.", metaData.getRequest.getBody.toString, requestBody)
Assert.assertFalse("response should not be empty", metaData.getRequest.isEmpty)
Assert.assertEquals("Invalid response content-type.", metaData.getResponse.getResponseContentType, contentType)
Assert.assertEquals("Invalid responseBody.", metaData.getResponse.getResponseBody.toString, responseBody)
Assert.assertEquals("Invalid responseBody.", metaData.getResponse.getBody.toString, responseBody)
Assert.assertEquals("Invalid protocol.", metaData.getRequest.getProtocol, "http")
}
}
14 changes: 6 additions & 8 deletions ...security/akka-http-core-2.11_10.0.11/src/main/scala/akka/http/scaladsl/AkkaCoreUtils.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,20 +35,18 @@ public static boolean acquireServletLockIfPossible() {
return GenericHelper.acquireLockIfPossible(VulnerabilityCaseType.REFLECTED_XSS, NR_SEC_CUSTOM_ATTRIB_NAME);
}

public static void postProcessHttpRequest(Boolean isServletLockAcquired, StringBuilder responseBody, String contentType, int responseCode, String className, String methodName, Token token) {
public static void postProcessHttpRequest(Boolean isServletLockAcquired, StringBuilder responseBody, String contentType, HashMap<String, String> headers, int responseCode, String className, String methodName, Token token) {
try {
if(NewRelicSecurity.getAgent().getIastDetectionCategory().getRxssEnabled()){
return;
}
token.linkAndExpire();

if(!isServletLockAcquired || !NewRelicSecurity.isHookProcessingActive()){
return;
}
NewRelicSecurity.getAgent().getSecurityMetaData().getResponse().setResponseContentType(contentType);
NewRelicSecurity.getAgent().getSecurityMetaData().getResponse().setResponseBody(responseBody);
NewRelicSecurity.getAgent().getSecurityMetaData().getResponse().setResponseCode(responseCode);
ServletHelper.executeBeforeExitingTransaction();
NewRelicSecurity.getAgent().getSecurityMetaData().getResponse().setContentType(contentType);
NewRelicSecurity.getAgent().getSecurityMetaData().getResponse().setBody(responseBody);
NewRelicSecurity.getAgent().getSecurityMetaData().getResponse().setStatusCode(responseCode);
NewRelicSecurity.getAgent().getSecurityMetaData().getResponse().setHeaders(headers);
// ServletHelper.executeBeforeExitingTransaction();

LowSeverityHelper.addRrequestUriToEventFilter(NewRelicSecurity.getAgent().getSecurityMetaData().getRequest());

Expand Down
11 changes: 7 additions & 4 deletions .../akka-http-core-2.11_10.0.11/src/main/scala/akka/http/scaladsl/ResponseFutureHelper.scala
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,12 +15,12 @@ import akka.stream.scaladsl.Sink
import akka.util.ByteString
import com.newrelic.api.agent.security.NewRelicSecurity
import com.newrelic.api.agent.security.instrumentation.helpers.GenericHelper
import com.newrelic.api.agent.security.schema.StringUtils
import com.newrelic.api.agent.security.schema.exceptions.NewRelicSecurityException
import com.newrelic.api.agent.security.utils.logging.LogLevel
import com.newrelic.api.agent.{NewRelic, Token}

import java.lang
import java.util.{HashMap => JavaHashMap}
import scala.concurrent.{ExecutionContext, Future}

object ResponseFutureHelper {
Expand All @@ -41,7 +41,9 @@ object ResponseFutureHelper {
processingResult.onComplete {
_ => {
token.linkAndExpire()
AkkaCoreUtils.postProcessHttpRequest(isLockAquired, stringResponse, response.entity.contentType.toString(), response.status.intValue(), this.getClass.getName, "apply", NewRelic.getAgent.getTransaction.getToken)
val headers = new JavaHashMap[String, String]()
response.headers.foreach(header => headers.put(header.name(), header.value()))
AkkaCoreUtils.postProcessHttpRequest(isLockAquired, stringResponse, response.entity.contentType.toString(), headers, response.status.intValue(), this.getClass.getName, "apply", NewRelic.getAgent.getTransaction.getToken)
}
}

Expand All @@ -67,8 +69,9 @@ object ResponseFutureHelper {
stringResponse.append(chunk)
}
val processingResult: Future[Done] = dataBytes.runWith(sink, materializer)

AkkaCoreUtils.postProcessHttpRequest(isLockAquired, stringResponse, httpResponse.entity.contentType.toString(), httpResponse.status.intValue(), this.getClass.getName, "apply", NewRelic.getAgent.getTransaction.getToken())
val headers = new JavaHashMap[String, String]()
httpResponse.headers.foreach(header => headers.put(header.name(), header.value()))
AkkaCoreUtils.postProcessHttpRequest(isLockAquired, stringResponse, httpResponse.entity.contentType.toString(), headers, httpResponse.status.intValue(), this.getClass.getName, "apply", NewRelic.getAgent.getTransaction.getToken())
} catch {
case t: NewRelicSecurityException =>
NewRelicSecurity.getAgent.log(LogLevel.WARNING, String.format(GenericHelper.SECURITY_EXCEPTION_MESSAGE, AkkaCoreUtils.AKKA_HTTP_CORE_10_0_11, t.getMessage), t, classOf[AkkaCoreUtils].getName)
Expand Down
4 changes: 2 additions & 2 deletions ...test/scala/com/nr/agent/security/instrumentation/akka/http/core_10/AkkaHttpCoreTest.scala
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -233,15 +233,15 @@ class AkkaHttpCoreTest {

Assert.assertFalse("response should not be empty", operation.getResponse.isEmpty)
Assert.assertEquals("Invalid response content-type.", operation.getResponse.getResponseContentType, contentType)
Assert.assertEquals("Invalid responseBody.", operation.getResponse.getResponseBody.toString, responseBody)
Assert.assertEquals("Invalid responseBody.", operation.getResponse.getBody.toString, responseBody)
}
private def assertMetaData(metaData: SecurityMetaData): Unit = {
Assert.assertFalse("response should not be empty", metaData.getResponse.isEmpty)
Assert.assertEquals("Invalid response content-type.", metaData.getRequest.getContentType, contentType)
Assert.assertEquals("Invalid responseBody.", metaData.getRequest.getBody.toString, requestBody)
Assert.assertFalse("response should not be empty", metaData.getRequest.isEmpty)
Assert.assertEquals("Invalid response content-type.", metaData.getResponse.getResponseContentType, contentType)
Assert.assertEquals("Invalid responseBody.", metaData.getResponse.getResponseBody.toString, responseBody)
Assert.assertEquals("Invalid responseBody.", metaData.getResponse.getBody.toString, responseBody)
Assert.assertEquals("Invalid protocol.", metaData.getRequest.getProtocol, "http")
}
}
12 changes: 5 additions & 7 deletions ...-security/akka-http-core-2.13_10.1.8/src/main/scala/akka/http/scaladsl/AkkaCoreUtils.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,18 +35,16 @@ public static boolean acquireServletLockIfPossible() {
return GenericHelper.acquireLockIfPossible(VulnerabilityCaseType.REFLECTED_XSS, NR_SEC_CUSTOM_ATTRIB_NAME);
}

public static void postProcessHttpRequest(Boolean isServletLockAcquired, StringBuilder responseBody, String contentType, int responseCode, String className, String methodName, Token token) {
public static void postProcessHttpRequest(Boolean isServletLockAcquired, StringBuilder responseBody, String contentType, Map<String, String> headers, int responseCode, String className, String methodName, Token token) {
try {
if(NewRelicSecurity.getAgent().getIastDetectionCategory().getRxssEnabled()){
return;
}
token.linkAndExpire();
if(!isServletLockAcquired || !NewRelicSecurity.isHookProcessingActive()){
return;
}
NewRelicSecurity.getAgent().getSecurityMetaData().getResponse().setResponseContentType(contentType);
NewRelicSecurity.getAgent().getSecurityMetaData().getResponse().setResponseBody(responseBody);
NewRelicSecurity.getAgent().getSecurityMetaData().getResponse().setResponseCode(responseCode);
NewRelicSecurity.getAgent().getSecurityMetaData().getResponse().setContentType(contentType);
NewRelicSecurity.getAgent().getSecurityMetaData().getResponse().setBody(responseBody);
NewRelicSecurity.getAgent().getSecurityMetaData().getResponse().setStatusCode(responseCode);
NewRelicSecurity.getAgent().getSecurityMetaData().getResponse().setHeaders(headers);
LowSeverityHelper.addRrequestUriToEventFilter(NewRelicSecurity.getAgent().getSecurityMetaData().getRequest());

if(!ServletHelper.isResponseContentTypeExcluded(NewRelicSecurity.getAgent().getSecurityMetaData().getResponse().getResponseContentType())) {
Expand Down
11 changes: 7 additions & 4 deletions ...y/akka-http-core-2.13_10.1.8/src/main/scala/akka/http/scaladsl/ResponseFutureHelper.scala
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,12 +15,12 @@ import akka.stream.scaladsl.Sink
import akka.util.ByteString
import com.newrelic.api.agent.security.NewRelicSecurity
import com.newrelic.api.agent.security.instrumentation.helpers.GenericHelper
import com.newrelic.api.agent.security.schema.StringUtils
import com.newrelic.api.agent.security.schema.exceptions.NewRelicSecurityException
import com.newrelic.api.agent.security.utils.logging.LogLevel
import com.newrelic.api.agent.{NewRelic, Token}

import java.lang
import java.util.{HashMap => JavaHashMap}
import scala.concurrent.{ExecutionContext, Future}

object ResponseFutureHelper {
Expand All @@ -41,7 +41,9 @@ object ResponseFutureHelper {
processingResult.onComplete {
_ => {
token.linkAndExpire()
AkkaCoreUtils.postProcessHttpRequest(isLockAquired, stringResponse, response.entity.contentType.toString(), response.status.intValue(), this.getClass.getName, "apply", NewRelic.getAgent.getTransaction.getToken)
val headers = new JavaHashMap[String, String]()
response.headers.foreach(header => headers.put(header.name(), header.value()))
AkkaCoreUtils.postProcessHttpRequest(isLockAquired, stringResponse, response.entity.contentType.toString(), headers, response.status.intValue(), this.getClass.getName, "apply", NewRelic.getAgent.getTransaction.getToken)
}
}

Expand All @@ -67,8 +69,9 @@ object ResponseFutureHelper {
stringResponse.append(chunk)
}
val processingResult: Future[Done] = dataBytes.runWith(sink, materializer)

AkkaCoreUtils.postProcessHttpRequest(isLockAquired, stringResponse, httpResponse.entity.contentType.toString(), httpResponse.status.intValue(), this.getClass.getName, "apply", NewRelic.getAgent.getTransaction.getToken)
val headers = new JavaHashMap[String, String]()
httpResponse.headers.foreach(header => headers.put(header.name(), header.value()))
AkkaCoreUtils.postProcessHttpRequest(isLockAquired, stringResponse, httpResponse.entity.contentType.toString(), headers, httpResponse.status.intValue(), this.getClass.getName, "apply", NewRelic.getAgent.getTransaction.getToken)
} catch {
case t: NewRelicSecurityException =>
NewRelicSecurity.getAgent.log(LogLevel.WARNING, String.format(GenericHelper.SECURITY_EXCEPTION_MESSAGE, AkkaCoreUtils.AKKA_HTTP_CORE_10_0_11, t.getMessage), t, classOf[AkkaCoreUtils].getName)
Expand Down
Loading
Loading