Skip to content

feat: Support to generate HTTP Response Security Event - #260

Open
sumitsuthar wants to merge 15 commits into
mainfrom
response_event
Open

feat: Support to generate HTTP Response Security Event #260
sumitsuthar wants to merge 15 commits into
mainfrom
response_event

Conversation

@sumitsuthar

@sumitsuthar sumitsuthar commented Oct 28, 2024 •
edited by atlassian Bot
Loading

Copy link
Copy Markdown
Contributor

Description

  • Handling to generate http response event.

How to Test

npm run test

Related Issues

Fixes: NR-325528

github-advanced-security[bot]
github-advanced-security AI found potential problems Feb 5, 2025
View reviewed changes
Comment thread lib/instrumentation-security/hooks/http/nr-http.js
transactionEvent.httpResponse.statusCode = response.statusCode;
transactionEvent.httpResponse.headers = response.getHeaders();
transactionEvent.httpResponse.contentType = response.getHeader(CONTENT_TYPE);
logger.debug("Response event is:", JSON.stringify(transactionEvent))

Check failure

Code scanning / CodeQL

Clear-text logging of sensitive information

This logs sensitive data returned by [process environment](1) as clear text. This logs sensitive data returned by [process environment](2) as clear text.

Copilot Autofix

AI over 1 year ago

To fix the problem, we need to ensure that sensitive information is not logged in clear text. The best way to fix this without changing existing functionality is to sanitize the transactionEvent object before logging it. We can remove or mask sensitive fields from the object before converting it to a JSON string and logging it.

We will modify the generateTransactionEvent function in the lib/instrumentation-security/hooks/http/nr-http.js file to sanitize the transactionEvent object before logging it. Specifically, we will remove or mask the sensitive fields such as applicationUUID, policyVersion, collectorVersion, and httpRequest.

Suggested changeset 1
lib/instrumentation-security/hooks/http/nr-http.js

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/lib/instrumentation-security/hooks/http/nr-http.js b/lib/instrumentation-security/hooks/http/nr-http.js
--- a/lib/instrumentation-security/hooks/http/nr-http.js
+++ b/lib/instrumentation-security/hooks/http/nr-http.js
@@ -527,3 +527,11 @@
   transactionEvent.httpResponse.contentType = response.getHeader(CONTENT_TYPE);
-  logger.debug("Response event is:", JSON.stringify(transactionEvent))
+  
+  // Sanitize sensitive information before logging
+  const sanitizedTransactionEvent = { ...transactionEvent };
+  delete sanitizedTransactionEvent.applicationUUID;
+  delete sanitizedTransactionEvent.policyVersion;
+  delete sanitizedTransactionEvent.collectorVersion;
+  delete sanitizedTransactionEvent.httpRequest;
+  
+  logger.debug("Response event is:", JSON.stringify(sanitizedTransactionEvent))
   API.sendEvent(transactionEvent);
EOF
@@ -527,3 +527,11 @@
transactionEvent.httpResponse.contentType = response.getHeader(CONTENT_TYPE);
logger.debug("Response event is:", JSON.stringify(transactionEvent))

// Sanitize sensitive information before logging
const sanitizedTransactionEvent = { ...transactionEvent };
delete sanitizedTransactionEvent.applicationUUID;
delete sanitizedTransactionEvent.policyVersion;
delete sanitizedTransactionEvent.collectorVersion;
delete sanitizedTransactionEvent.httpRequest;

logger.debug("Response event is:", JSON.stringify(sanitizedTransactionEvent))
API.sendEvent(transactionEvent);
Copilot is powered by AI and may make mistakes. Always verify output.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@sumitsuthar @github-advanced-security