From dafb2594c8a3a47e9463d021e4ef34181644fbf8 Mon Sep 17 00:00:00 2001 From: Sumit Suthar Date: Tue, 3 Oct 2023 16:29:29 +0530 Subject: [PATCH 1/5] mongo eval hook --- .../core/event-constants.js | 6 ++++-- .../hooks/mongodb/common.js | 21 +++++++++++++++++++ 2 files changed, 25 insertions(+), 2 deletions(-) diff --git a/lib/instrumentation-security/core/event-constants.js b/lib/instrumentation-security/core/event-constants.js index 41c986b4..eec93db2 100644 --- a/lib/instrumentation-security/core/event-constants.js +++ b/lib/instrumentation-security/core/event-constants.js @@ -20,7 +20,8 @@ const EVENT_TYPE = { UNVALIDATED_REDIRECT: 'UNVALIDATED_REDIRECT', REFLECTED_XSS: 'REFLECTED_XSS', XPATH: 'XPATH', - LDAP: 'LDAP' + LDAP: 'LDAP', + JS_INJECTION: 'JAVASCRIPT_INJECTION' } const EVENT_CATEGORY = { MYSQL: 'MYSQL', @@ -40,7 +41,8 @@ const EVENT_CATEGORY = { UNVALIDATED_REDIRECT: 'UNVALIDATED_REDIRECT', REFLECTED_XSS: 'REFLECTED_XSS', XPATH: 'XPATH', - LDAP: 'LDAP' + LDAP: 'LDAP', + JS_INJECTION: 'JAVASCRIPT_INJECTION' } module.exports = { diff --git a/lib/instrumentation-security/hooks/mongodb/common.js b/lib/instrumentation-security/hooks/mongodb/common.js index d180b101..a31419bd 100644 --- a/lib/instrumentation-security/hooks/mongodb/common.js +++ b/lib/instrumentation-security/hooks/mongodb/common.js @@ -165,7 +165,28 @@ common.instrumentBulkOperation = function instrumentBulkOperation( common.instrumentDb = function instrumentDb(shim, Db) { if (Db && Db.prototype) { const proto = Db.prototype; + const request = requestManager.getRequest(shim); + shim.wrap(proto, 'eval', function callbackWrapper(shim, fn) { + if (!shim.isFunction(fn)) { + return fn; + } + return function wrapper() { + const payload = [arguments[0]]; + shim.interceptedArgs = payload; + if (request && shim.interceptedArgs) { + //generate event here + const traceObject = secUtils.getTraceObject(shim); + const secMetadata = securityMetaData.getSecurityMetaData(request, payload, traceObject, secUtils.getExecutionId(), EVENT_TYPE.JS_INJECTION, EVENT_CATEGORY.JS_INJECTION) + const secEvent = API.generateSecEvent(secMetadata); + API.sendEvent(secEvent); + } + return fn.apply(this, arguments); + } + }) + } + + //here need to add hooks for DB ops }; From d9c408d82689694eaad2d979ad6d69079460f7fa Mon Sep 17 00:00:00 2001 From: Sumit Suthar Date: Fri, 8 Dec 2023 16:22:22 +0530 Subject: [PATCH 2/5] cleanup --- lib/instrumentation-security/hooks/mongodb/common.js | 3 --- 1 file changed, 3 deletions(-) diff --git a/lib/instrumentation-security/hooks/mongodb/common.js b/lib/instrumentation-security/hooks/mongodb/common.js index 8a7a13d5..03a529b6 100644 --- a/lib/instrumentation-security/hooks/mongodb/common.js +++ b/lib/instrumentation-security/hooks/mongodb/common.js @@ -175,7 +175,6 @@ common.instrumentDb = function instrumentDb(shim, Db) { const payload = [arguments[0]]; shim.interceptedArgs = payload; if (request && shim.interceptedArgs) { - //generate event here const traceObject = secUtils.getTraceObject(shim); const secMetadata = securityMetaData.getSecurityMetaData(request, payload, traceObject, secUtils.getExecutionId(), EVENT_TYPE.JS_INJECTION, EVENT_CATEGORY.JS_INJECTION) const secEvent = API.generateSecEvent(secMetadata); @@ -187,8 +186,6 @@ common.instrumentDb = function instrumentDb(shim, Db) { } - - //here need to add hooks for DB ops }; /** From 7bb6be1e912da188419cae44af08dce68a968285 Mon Sep 17 00:00:00 2001 From: Sumit Suthar Date: Fri, 19 Jan 2024 13:07:57 +0530 Subject: [PATCH 3/5] fix for eval hook --- lib/instrumentation-security/hooks/mongodb/common.js | 7 ++++++- lib/instrumentation-security/hooks/mongodb/v2-mongo.js | 5 +++-- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/lib/instrumentation-security/hooks/mongodb/common.js b/lib/instrumentation-security/hooks/mongodb/common.js index 03a529b6..6f642c04 100644 --- a/lib/instrumentation-security/hooks/mongodb/common.js +++ b/lib/instrumentation-security/hooks/mongodb/common.js @@ -166,13 +166,18 @@ common.instrumentBulkOperation = function instrumentBulkOperation( common.instrumentDb = function instrumentDb(shim, Db) { if (Db && Db.prototype) { const proto = Db.prototype; - const request = requestManager.getRequest(shim); + let request = requestManager.getRequest(shim); shim.wrap(proto, 'eval', function callbackWrapper(shim, fn) { if (!shim.isFunction(fn)) { return fn; } return function wrapper() { const payload = [arguments[0]]; + let linkingMetadata = shim.agent.getLinkingMetadata(); + if (linkingMetadata['trace.id'] && !request) { + let traceId = linkingMetadata['trace.id']; + request = requestManager.getRequestFromId(traceId); + } shim.interceptedArgs = payload; if (request && shim.interceptedArgs) { const traceObject = secUtils.getTraceObject(shim); diff --git a/lib/instrumentation-security/hooks/mongodb/v2-mongo.js b/lib/instrumentation-security/hooks/mongodb/v2-mongo.js index decfd7ee..a883ac0e 100644 --- a/lib/instrumentation-security/hooks/mongodb/v2-mongo.js +++ b/lib/instrumentation-security/hooks/mongodb/v2-mongo.js @@ -6,7 +6,7 @@ 'use strict' -const { captureAttributesOnStarted, makeQueryDescFunc, queryHookV2 } = require('./common') +const { captureAttributesOnStarted, makeQueryDescFunc, queryHookV2, instrumentDb } = require('./common') /** * Registers relevant instrumentation for mongo <= 3.0.6 @@ -19,6 +19,7 @@ const { captureAttributesOnStarted, makeQueryDescFunc, queryHookV2 } = require(' * @param {object} mongodb resolved package */ module.exports = function instrument(shim, mongodb) { + instrumentDb(shim, mongodb.Db); const recordDesc = { Gridstore: { @@ -78,7 +79,7 @@ module.exports = function instrument(shim, mongodb) { methods.forEach((method) => { const { isQuery, makeDescFunc } = recordDesc[objectName] const proto = object.prototype - if (isQuery && method!='execute') { + if (isQuery && method != 'execute') { queryHookV2(shim, proto, method); } else if (isQuery === false) { // could be unset From 1166a666c8c0e26f5c7dc84d22d624d16b668bee Mon Sep 17 00:00:00 2001 From: Sumit Suthar Date: Fri, 19 Jan 2024 13:18:26 +0530 Subject: [PATCH 4/5] added logger for mongodb.eval --- lib/instrumentation-security/hooks/mongodb/common.js | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/instrumentation-security/hooks/mongodb/common.js b/lib/instrumentation-security/hooks/mongodb/common.js index 6f642c04..012b00f1 100644 --- a/lib/instrumentation-security/hooks/mongodb/common.js +++ b/lib/instrumentation-security/hooks/mongodb/common.js @@ -168,6 +168,7 @@ common.instrumentDb = function instrumentDb(shim, Db) { const proto = Db.prototype; let request = requestManager.getRequest(shim); shim.wrap(proto, 'eval', function callbackWrapper(shim, fn) { + logger.debug(`Instrumenting mongodb.eval`); if (!shim.isFunction(fn)) { return fn; } From 2c4fafe6d2345a2bda5ee904708b549222aad250 Mon Sep 17 00:00:00 2001 From: Sumit Suthar Date: Mon, 22 Jan 2024 16:49:39 +0530 Subject: [PATCH 5/5] null check --- lib/instrumentation-security/hooks/mongodb/common.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/instrumentation-security/hooks/mongodb/common.js b/lib/instrumentation-security/hooks/mongodb/common.js index 012b00f1..252511da 100644 --- a/lib/instrumentation-security/hooks/mongodb/common.js +++ b/lib/instrumentation-security/hooks/mongodb/common.js @@ -180,7 +180,7 @@ common.instrumentDb = function instrumentDb(shim, Db) { request = requestManager.getRequestFromId(traceId); } shim.interceptedArgs = payload; - if (request && shim.interceptedArgs) { + if (request && shim.interceptedArgs && arguments[0]) { const traceObject = secUtils.getTraceObject(shim); const secMetadata = securityMetaData.getSecurityMetaData(request, payload, traceObject, secUtils.getExecutionId(), EVENT_TYPE.JS_INJECTION, EVENT_CATEGORY.JS_INJECTION) const secEvent = API.generateSecEvent(secMetadata);