feat: Support to generate HTTP Response Security Event

lib/instrumentation-security/hooks/http/nr-http.js

@@ -22,6 +22,7 @@
 const securityMetaData = require('../../core/security-metadata');
 const { EVENT_TYPE, EVENT_CATEGORY } = require('../../core/event-constants');
 const hc = require('../../../nr-security-agent/lib/core/health-check');
+const LinkingMetaData = require('../../../nr-security-agent/lib/core/LinkingMetadata');
 
 const NRCSECTRACINGDATA = 'NR-CSEC-TRACING-DATA';
 const SELFTEST = 'self-test';
@@ -454,28 +455,79 @@
       }
 
       responseBodyCompute(response, arguments);
+      if (NRAgent && NRAgent.config.security.detection.rxss.enabled && NRAgent.config.security.scan_controllers.report_http_response_body) {
+        const construct = API.checkForReflectedXSS(request, response.res.body, response.getHeaders());
+        const policy = API.getPolicy();
+        const dynamicScanningFlag = policy.data ? (policy.data.vulnerabilityScan?.enabled && policy.data.vulnerabilityScan.iastScan.enabled) : false;
+        const type = response.getHeader(CONTENT_TYPE);
+        let isUnsupportedType = isUnsupportedContentType(type, response);
+
+        if (request && (construct || dynamicScanningFlag) && !isUnsupportedType) {
+          const args = [];
+          args.push(construct);
+          args.push(response.res.body);
+          const traceObject = secUtils.getTraceObject(shim);
+          const secMetadata = securityMetaData.getSecurityMetaData(request, args, traceObject, secUtils.getExecutionId(), EVENT_TYPE.REFLECTED_XSS, EVENT_CATEGORY.REFLECTED_XSS)
+          const secEvent = API.generateSecEvent(secMetadata);
+          secEvent.httpResponse = {};
+          secEvent.httpResponse.contentType = response.getHeader(CONTENT_TYPE);
+          API.sendEvent(secEvent);
+        }
+      }
 
-      const construct = API.checkForReflectedXSS(request, response.res.body, response.getHeaders());
-      const policy = API.getPolicy();
-      const dynamicScanningFlag = policy.data ? (policy.data.vulnerabilityScan?.enabled && policy.data.vulnerabilityScan.iastScan.enabled) : false;
-      const type = response.getHeader(CONTENT_TYPE);
-      let isUnsupportedType = isUnsupportedContentType(type, response);
-
-      if (request && (construct || dynamicScanningFlag) && !isUnsupportedType) {
-        const args = [];
-        args.push(construct);
-        args.push(response.res.body);
-        const traceObject = secUtils.getTraceObject(shim);
-        const secMetadata = securityMetaData.getSecurityMetaData(request, args, traceObject, secUtils.getExecutionId(), EVENT_TYPE.REFLECTED_XSS, EVENT_CATEGORY.REFLECTED_XSS)
-        const secEvent = API.generateSecEvent(secMetadata);
-        secEvent.httpResponse = {};
-        secEvent.httpResponse.contentType = response.getHeader(CONTENT_TYPE);
-        API.sendEvent(secEvent);
+
+      if (request && API && API.getSecAgent() && NRAgent.config.security.scan_controllers && NRAgent.config.security.scan_controllers.report_http_response_body) {
+        const fuzzHeader = request.headers[NR_CSEC_FUZZ_REQUEST_ID];
+        if (fuzzHeader && fuzzHeader.includes('VULNERABLE'))
+          generateTransactionEvent(request, response);
       }
+
+
       return fn.apply(this, arguments);
     }
   })
 }
+
+/**
+ * Generate transactionEvent
+ */
+function generateTransactionEvent(request, response) {
+  let transactionEvent = {};
+  let applicationInfo = API.getSecAgent().applicationInfo;
+  transactionEvent.jsonVersion = applicationInfo.jsonVersion;
+  transactionEvent.pid = applicationInfo.pid ? applicationInfo.pid : null;
+  transactionEvent.jsonName = 'sec_http_response';
+  transactionEvent.eventType = transactionEvent.jsonName;
+  if (NRAgent) {
+    transactionEvent.appEntityGuid = NRAgent.config.entity_guid;
+    transactionEvent.appAccountId = NRAgent.config.account_id;
+    transactionEvent.linkingMetadata = LinkingMetaData.getLinkingMetadata();
+    transactionEvent.traceId = transactionEvent.linkingMetadata['trace.id'];
+  }
+  transactionEvent.applicationUUID = applicationInfo.applicationUUID;
+  transactionEvent.policyVersion = applicationInfo.policyVersion;
+  transactionEvent.collectorVersion = applicationInfo.collectorVersion ? applicationInfo.collectorVersion : null;
+  transactionEvent.buildNumber = applicationInfo.buildNumber ? applicationInfo.buildNumber : null;
+  transactionEvent.timestamp = Date.now();
+  transactionEvent.httpRequest = request;
+  transactionEvent.httpResponse = {};
+  let responseBody = response.res.body;
+  try {
+    const contentLength = Buffer.byteLength(responseBody, 'utf8');
+    let bodyLimit = 500000;
+    if (contentLength && contentLength > bodyLimit) {
+      responseBody = truncateStringToBytes(responseBody, bodyLimit);
+    }
+  } catch (error) {
+    logger.error("Error while truncating response body", error);
+  }
+  transactionEvent.httpResponse.body = responseBody;
+  transactionEvent.httpResponse.statusCode = response.statusCode;
+  transactionEvent.httpResponse.headers = response.getHeaders();
+  transactionEvent.httpResponse.contentType = response.getHeader(CONTENT_TYPE);
+  logger.debug("Response event is:", JSON.stringify(transactionEvent))
+  API.sendEvent(transactionEvent);
+}
 /**
  * Utility to check unsupported content types
  * @param {*} conType 
@@ -535,6 +587,9 @@
 }
 
 function responseBodyCompute(response, args) {
+  if(NRAgent && !NRAgent.config.security.scan_controllers.report_http_response_body){
+    return;
+  }
   let encoding = UTF8;
   const type = response.getHeader(CONTENT_TYPE);
   let isUnsupportedType = isUnsupportedContentType(type, response);

lib/nr-security-api/index.js

@@ -23,6 +23,7 @@ function getNRAgent() {
         NRAgent.config.security.scan_controllers = {};
         NRAgent.config.security.scan_controllers.iast_scan_request_rate_limit = 3600;
         NRAgent.config.security.scan_controllers.scan_instance_count = 0;
+        NRAgent.config.security.scan_controllers.report_http_response_body = true;
     }
     if (NRAgent && NRAgent.config && !NRAgent.config.security.exclude_from_iast_scan) {
         NRAgent.config.security.exclude_from_iast_scan = {};
@@ -43,6 +44,7 @@ function getNRAgent() {
         NRAgent.config.security.exclude_from_iast_scan.iast_detection_category.ssrf = false;
         NRAgent.config.security.exclude_from_iast_scan.iast_detection_category.rxss = false;
     }
+
     return NRAgent;
 }