feat: Handling to generate security events for mongodb.eval

lib/instrumentation-security/core/event-constants.js

@@ -20,7 +20,8 @@ const EVENT_TYPE = {
     UNVALIDATED_REDIRECT: 'UNVALIDATED_REDIRECT',
     REFLECTED_XSS: 'REFLECTED_XSS',
     XPATH: 'XPATH',
-    LDAP: 'LDAP'
+    LDAP: 'LDAP',
+    JS_INJECTION: 'JAVASCRIPT_INJECTION'
 }
 const  EVENT_CATEGORY =  {
     MYSQL: 'MYSQL',
@@ -40,7 +41,8 @@ const  EVENT_CATEGORY =  {
     UNVALIDATED_REDIRECT: 'UNVALIDATED_REDIRECT',
     REFLECTED_XSS: 'REFLECTED_XSS',
     XPATH: 'XPATH',
-    LDAP: 'LDAP'
+    LDAP: 'LDAP',
+    JS_INJECTION: 'JAVASCRIPT_INJECTION'
 }
 
 module.exports = {

lib/instrumentation-security/hooks/mongodb/common.js

@@ -166,8 +166,32 @@ common.instrumentBulkOperation = function instrumentBulkOperation(
 common.instrumentDb = function instrumentDb(shim, Db) {
   if (Db && Db.prototype) {
     const proto = Db.prototype;
+    let request = requestManager.getRequest(shim);
+    shim.wrap(proto, 'eval', function callbackWrapper(shim, fn) {
+      logger.debug(`Instrumenting mongodb.eval`);
+      if (!shim.isFunction(fn)) {
+        return fn;
+      }
+      return function wrapper() {
+        const payload = [arguments[0]];
+        let linkingMetadata = shim.agent.getLinkingMetadata();
+        if (linkingMetadata['trace.id'] && !request) {
+            let traceId = linkingMetadata['trace.id'];
+            request = requestManager.getRequestFromId(traceId);
+        }
+        shim.interceptedArgs = payload;
+        if (request && shim.interceptedArgs && arguments[0]) {
+          const traceObject = secUtils.getTraceObject(shim);
+          const secMetadata = securityMetaData.getSecurityMetaData(request, payload, traceObject, secUtils.getExecutionId(), EVENT_TYPE.JS_INJECTION, EVENT_CATEGORY.JS_INJECTION)
+          const secEvent = API.generateSecEvent(secMetadata);
+          API.sendEvent(secEvent);
+        }
+        return fn.apply(this, arguments);
+      }
+    })
+
   }
-  //here need to add hooks for DB ops
+
 };
 
 /**

lib/instrumentation-security/hooks/mongodb/v2-mongo.js

@@ -6,7 +6,7 @@
 
 'use strict'
 
-const { captureAttributesOnStarted, makeQueryDescFunc, queryHookV2 } = require('./common')
+const { captureAttributesOnStarted, makeQueryDescFunc, queryHookV2, instrumentDb } = require('./common')
 
 /**
  * Registers relevant instrumentation for mongo <= 3.0.6
@@ -19,6 +19,7 @@ const { captureAttributesOnStarted, makeQueryDescFunc, queryHookV2 } = require('
  * @param {object} mongodb resolved package
  */
 module.exports = function instrument(shim, mongodb) {
+  instrumentDb(shim, mongodb.Db);
 
   const recordDesc = {
     Gridstore: {
@@ -78,7 +79,7 @@ module.exports = function instrument(shim, mongodb) {
       methods.forEach((method) => {
         const { isQuery, makeDescFunc } = recordDesc[objectName]
         const proto = object.prototype
-        if (isQuery && method!='execute') {
+        if (isQuery && method != 'execute') {
           queryHookV2(shim, proto, method);
         } else if (isQuery === false) {
           // could be unset