Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

NR-256007 - Fix NoClassDefFoundError raised in javax packages #226

Merged
merged 2 commits into from
Apr 30, 2024
Merged

NR-256007 - Fix NoClassDefFoundError raised in javax packages #226

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3db4c89
NR-256007 - Fix NoClassDefFoundError raised in javax packages
lovesh-ap Apr 5, 2024
3e0d255
Merge branch 'develop' into fix/NCDFE-NR-256007
lovesh-ap Apr 5, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion instrumentation-security/javax-jndi/src/main/java/javax/naming/Context_Instrumentation.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@
import com.newrelic.api.agent.weaver.MatchType;
import com.newrelic.api.agent.weaver.Weave;
import com.newrelic.api.agent.weaver.Weaver;
import com.newrelic.agent.security.instrumentation.javax.jndi.JNDIUtils;

import java.util.Enumeration;
import java.util.List;
Expand Down
2 changes: 1 addition & 1 deletion ...instrumentation/javax/jndi/JNDIUtils.java → ...src/main/java/javax/naming/JNDIUtils.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
package com.newrelic.agent.security.instrumentation.javax.jndi;
package javax.naming;

import com.newrelic.api.agent.security.NewRelicSecurity;
import com.newrelic.api.agent.security.instrumentation.helpers.GenericHelper;
Expand Down
2 changes: 1 addition & 1 deletion ...x-jndi/src/test/java/com/nr/agent/security/instrumentation/javax/jndi/ContextRmiTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
import com.newrelic.api.agent.security.schema.AbstractOperation;
import com.newrelic.api.agent.security.schema.VulnerabilityCaseType;
import com.newrelic.api.agent.security.schema.operation.SSRFOperation;
import com.newrelic.agent.security.instrumentation.javax.jndi.JNDIUtils;
import javax.naming.JNDIUtils;
import org.junit.Assert;
import org.junit.FixMethodOrder;
import org.junit.Test;
Expand Down
2 changes: 1 addition & 1 deletion ...avax-jndi/src/test/java/com/nr/agent/security/instrumentation/javax/jndi/ContextTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
import com.newrelic.api.agent.security.schema.AbstractOperation;
import com.newrelic.api.agent.security.schema.VulnerabilityCaseType;
import com.newrelic.api.agent.security.schema.operation.SSRFOperation;
import com.newrelic.agent.security.instrumentation.javax.jndi.JNDIUtils;
import javax.naming.JNDIUtils;
import com.unboundid.ldap.sdk.LDAPException;
import org.junit.Assert;
import org.junit.BeforeClass;
Expand Down
1 change: 0 additions & 1 deletion ...-security/javax-ldap/src/main/java/javax/naming/directory/DirContext_Instrumentation.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@
import com.newrelic.api.agent.weaver.MatchType;
import com.newrelic.api.agent.weaver.Weave;
import com.newrelic.api.agent.weaver.Weaver;
import com.newrelic.agent.security.instrumentation.javax.ldap.LDAPUtils;

import javax.naming.Context;
import javax.naming.Name;
Expand Down
2 changes: 1 addition & 1 deletion ...instrumentation/javax/ldap/LDAPUtils.java → ...ava/javax/naming/directory/LDAPUtils.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
package com.newrelic.agent.security.instrumentation.javax.ldap;
package javax.naming.directory;

public class LDAPUtils {

Expand Down
2 changes: 1 addition & 1 deletion ...x-ldap/src/test/java/com/nr/agent/security/instrumentation/javax/ldap/DirContextTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@
import java.util.List;

@RunWith(SecurityInstrumentationTestRunner.class)
@InstrumentationTestConfig(includePrefixes = { "javax.naming", "com.newrelic.agent.security.instrumentation.javax.ldap.LDAPUtils" } )
@InstrumentationTestConfig(includePrefixes = { "javax.naming", "javax.naming.directory.LDAPUtils" } )
@FixMethodOrder(MethodSorters.NAME_ASCENDING)
//FIXME: after instrumentation works
@Ignore
Expand Down
10 changes: 0 additions & 10 deletions ...ath/src/main/java/com/newrelic/agent/security/instrumentation/xpath/javax/XPATHUtils.java
View file
Open in desktop

This file was deleted.

15 changes: 7 additions & 8 deletions ...ty/javax-xpath/src/main/java/com/sun/org/apache/xpath/internal/XPath_Instrumentation.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@
import com.newrelic.api.agent.weaver.MatchType;
import com.newrelic.api.agent.weaver.Weave;
import com.newrelic.api.agent.weaver.Weaver;
import com.newrelic.agent.security.instrumentation.xpath.javax.XPATHUtils;
import com.sun.org.apache.xml.internal.utils.PrefixResolver;
import com.sun.org.apache.xpath.internal.objects.XObject;

Expand All @@ -26,7 +25,7 @@ public XObject execute(
boolean isLockAcquired = acquireLockIfPossible();
AbstractOperation operation = null;
if(isLockAcquired) {
operation = preprocessSecurityHook(getPatternString(), XPATHUtils.METHOD_EXECUTE);
operation = preprocessSecurityHook(getPatternString(), "execute");
}

XObject returnVal = null;
Expand All @@ -49,7 +48,7 @@ public XObject execute(
boolean isLockAcquired = acquireLockIfPossible();
AbstractOperation operation = null;
if(isLockAcquired) {
operation = preprocessSecurityHook(getPatternString(), XPATHUtils.METHOD_EXECUTE);
operation = preprocessSecurityHook(getPatternString(), "execute");
}

XObject returnVal = null;
Expand Down Expand Up @@ -87,24 +86,24 @@ private AbstractOperation preprocessSecurityHook (String patternString, String m
return xPathOperation;
} catch (Throwable e) {
if (e instanceof NewRelicSecurityException) {
NewRelicSecurity.getAgent().log(LogLevel.WARNING, String.format(GenericHelper.SECURITY_EXCEPTION_MESSAGE, XPATHUtils.JAVAX_XPATH, e.getMessage()), e, this.getClass().getName());
NewRelicSecurity.getAgent().log(LogLevel.WARNING, String.format(GenericHelper.SECURITY_EXCEPTION_MESSAGE, "JAVAX-XPATH", e.getMessage()), e, this.getClass().getName());
throw e;
}
NewRelicSecurity.getAgent().log(LogLevel.SEVERE, String.format(GenericHelper.REGISTER_OPERATION_EXCEPTION_MESSAGE, XPATHUtils.JAVAX_XPATH, e.getMessage()), e, this.getClass().getName());
NewRelicSecurity.getAgent().reportIncident(LogLevel.SEVERE , String.format(GenericHelper.REGISTER_OPERATION_EXCEPTION_MESSAGE, XPATHUtils.JAVAX_XPATH, e.getMessage()), e, this.getClass().getName());
NewRelicSecurity.getAgent().log(LogLevel.SEVERE, String.format(GenericHelper.REGISTER_OPERATION_EXCEPTION_MESSAGE, "JAVAX-XPATH", e.getMessage()), e, this.getClass().getName());
NewRelicSecurity.getAgent().reportIncident(LogLevel.SEVERE , String.format(GenericHelper.REGISTER_OPERATION_EXCEPTION_MESSAGE, "JAVAX-XPATH", e.getMessage()), e, this.getClass().getName());
}
return null;
}

private void releaseLock() {
try {
GenericHelper.releaseLock(XPATHUtils.NR_SEC_CUSTOM_ATTRIB_NAME);
GenericHelper.releaseLock("XPATH_OPERATION_LOCK_JAVAXPATH-");
} catch (Throwable ignored) {}
}

private boolean acquireLockIfPossible() {
try {
return GenericHelper.acquireLockIfPossible(XPATHUtils.NR_SEC_CUSTOM_ATTRIB_NAME);
return GenericHelper.acquireLockIfPossible("XPATH_OPERATION_LOCK_JAVAXPATH-");
} catch (Throwable ignored) {}
return false;
}
Expand Down
21 changes: 10 additions & 11 deletions ...rumentation-security/javax-xpath/src/main/java/javax/xml/xpath/XPath_Instrumentation.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@
import com.newrelic.api.agent.weaver.MatchType;
import com.newrelic.api.agent.weaver.Weave;
import com.newrelic.api.agent.weaver.Weaver;
import com.newrelic.agent.security.instrumentation.xpath.javax.XPATHUtils;
import org.xml.sax.InputSource;

import javax.xml.namespace.QName;
Expand All @@ -23,7 +22,7 @@ public String evaluate(String expression, InputSource source)
boolean isLockAcquired = acquireLockIfPossible();
AbstractOperation operation = null;
if(isLockAcquired) {
operation = preprocessSecurityHook(expression, XPATHUtils.METHOD_EVALUATE);
operation = preprocessSecurityHook(expression, "evaluate");
}

String returnVal = null;
Expand All @@ -46,7 +45,7 @@ public Object evaluate(
boolean isLockAcquired = acquireLockIfPossible();
AbstractOperation operation = null;
if(isLockAcquired) {
operation = preprocessSecurityHook(expression, XPATHUtils.METHOD_EVALUATE);
operation = preprocessSecurityHook(expression, "evaluate");
}

Object returnVal = null;
Expand All @@ -66,7 +65,7 @@ public String evaluate(String expression, Object item)
boolean isLockAcquired = acquireLockIfPossible();
AbstractOperation operation = null;
if(isLockAcquired) {
operation = preprocessSecurityHook(expression, XPATHUtils.METHOD_EVALUATE);
operation = preprocessSecurityHook(expression, "evaluate");
}

String returnVal = null;
Expand All @@ -86,7 +85,7 @@ public Object evaluate(String expression, Object item, QName returnType)
boolean isLockAcquired = acquireLockIfPossible();
AbstractOperation operation = null;
if(isLockAcquired) {
operation = preprocessSecurityHook(expression, XPATHUtils.METHOD_EVALUATE);
operation = preprocessSecurityHook(expression, "evaluate");
}

Object returnVal = null;
Expand All @@ -110,7 +109,7 @@ private void registerExitOperation(boolean isProcessingAllowed, AbstractOperatio
}
NewRelicSecurity.getAgent().registerExitEvent(operation);
} catch (Throwable ignored){
NewRelicSecurity.getAgent().log(LogLevel.FINEST, String.format(GenericHelper.EXIT_OPERATION_EXCEPTION_MESSAGE, XPATHUtils.JAVAX_XPATH, ignored.getMessage()), ignored, this.getClass().getName());
NewRelicSecurity.getAgent().log(LogLevel.FINEST, String.format(GenericHelper.EXIT_OPERATION_EXCEPTION_MESSAGE, "JAVAX-XPATH", ignored.getMessage()), ignored, this.getClass().getName());
}
}

Expand All @@ -126,24 +125,24 @@ private AbstractOperation preprocessSecurityHook (String patternString, String m
return xPathOperation;
} catch (Throwable e) {
if (e instanceof NewRelicSecurityException) {
NewRelicSecurity.getAgent().log(LogLevel.WARNING, String.format(GenericHelper.SECURITY_EXCEPTION_MESSAGE, XPATHUtils.JAVAX_XPATH, e.getMessage()), e, this.getClass().getName());
NewRelicSecurity.getAgent().log(LogLevel.WARNING, String.format(GenericHelper.SECURITY_EXCEPTION_MESSAGE, "JAVAX-XPATH", e.getMessage()), e, this.getClass().getName());
throw e;
}
NewRelicSecurity.getAgent().log(LogLevel.SEVERE, String.format(GenericHelper.REGISTER_OPERATION_EXCEPTION_MESSAGE, XPATHUtils.JAVAX_XPATH, e.getMessage()), e, this.getClass().getName());
NewRelicSecurity.getAgent().reportIncident(LogLevel.SEVERE , String.format(GenericHelper.REGISTER_OPERATION_EXCEPTION_MESSAGE, XPATHUtils.JAVAX_XPATH, e.getMessage()), e, this.getClass().getName());
NewRelicSecurity.getAgent().log(LogLevel.SEVERE, String.format(GenericHelper.REGISTER_OPERATION_EXCEPTION_MESSAGE, "JAVAX-XPATH", e.getMessage()), e, this.getClass().getName());
NewRelicSecurity.getAgent().reportIncident(LogLevel.SEVERE , String.format(GenericHelper.REGISTER_OPERATION_EXCEPTION_MESSAGE, "JAVAX-XPATH", e.getMessage()), e, this.getClass().getName());
}
return null;
}

private void releaseLock() {
try {
GenericHelper.releaseLock(XPATHUtils.NR_SEC_CUSTOM_ATTRIB_NAME);
GenericHelper.releaseLock("XPATH_OPERATION_LOCK_JAVAXPATH-");
} catch (Throwable ignored) {}
}

private boolean acquireLockIfPossible() {
try {
return GenericHelper.acquireLockIfPossible(XPATHUtils.NR_SEC_CUSTOM_ATTRIB_NAME);
return GenericHelper.acquireLockIfPossible("XPATH_OPERATION_LOCK_JAVAXPATH-");
} catch (Throwable ignored) {}
return false;
}
Expand Down
19 changes: 10 additions & 9 deletions ...avax-xpath/src/test/java/com/nr/agent/security/instrumentation/xpath/javax/XPathTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,6 @@
import com.newrelic.api.agent.security.schema.AbstractOperation;
import com.newrelic.api.agent.security.schema.VulnerabilityCaseType;
import com.newrelic.api.agent.security.schema.operation.XPathOperation;
import com.newrelic.agent.security.instrumentation.xpath.javax.XPATHUtils;
import com.newrelic.security.test.marker.Java17IncompatibleTest;
import org.junit.Assert;
import org.junit.FixMethodOrder;
Expand All @@ -33,6 +32,8 @@ public class XPathTest {
private final String XML_DOC = "src/test/resources/Customer.xml";
private final String EXPRESSION = "/Customers/Customer";

public static final String METHOD_EVALUATE = "evaluate";

@Test
public void testEvaluate() throws Exception {
InputSource source = new InputSource(XML_DOC);
Expand All @@ -46,7 +47,7 @@ public void testEvaluate() throws Exception {
XPathOperation operation = (XPathOperation) operations.get(0);

Assert.assertEquals("Invalid event category.", VulnerabilityCaseType.XPATH, operation.getCaseType());
Assert.assertEquals("Invalid executed method name.", XPATHUtils.METHOD_EVALUATE, operation.getMethodName());
Assert.assertEquals("Invalid executed method name.", METHOD_EVALUATE, operation.getMethodName());
Assert.assertEquals("Invalid expression", EXPRESSION, operation.getExpression());
}

Expand All @@ -63,7 +64,7 @@ public void testEvaluate1() throws Exception {
XPathOperation operation = (XPathOperation) operations.get(0);

Assert.assertEquals("Invalid event category.", VulnerabilityCaseType.XPATH, operation.getCaseType());
Assert.assertEquals("Invalid executed method name.", XPATHUtils.METHOD_EVALUATE, operation.getMethodName());
Assert.assertEquals("Invalid executed method name.", METHOD_EVALUATE, operation.getMethodName());
Assert.assertEquals("Invalid expression", EXPRESSION, operation.getExpression());
}

Expand All @@ -80,7 +81,7 @@ public void testEvaluate2() throws Exception {
XPathOperation operation = (XPathOperation) operations.get(0);

Assert.assertEquals("Invalid event category.", VulnerabilityCaseType.XPATH, operation.getCaseType());
Assert.assertEquals("Invalid executed method name.", XPATHUtils.METHOD_EVALUATE, operation.getMethodName());
Assert.assertEquals("Invalid executed method name.", METHOD_EVALUATE, operation.getMethodName());
Assert.assertEquals("Invalid expression", EXPRESSION, operation.getExpression());
}

Expand All @@ -97,7 +98,7 @@ public void testEvaluate3() throws Exception {
XPathOperation operation = (XPathOperation) operations.get(0);

Assert.assertEquals("Invalid event category.", VulnerabilityCaseType.XPATH, operation.getCaseType());
Assert.assertEquals("Invalid executed method name.", XPATHUtils.METHOD_EVALUATE, operation.getMethodName());
Assert.assertEquals("Invalid executed method name.", METHOD_EVALUATE, operation.getMethodName());
Assert.assertEquals("Invalid expression", EXPRESSION, operation.getExpression());
}
@Test
Expand All @@ -114,7 +115,7 @@ public void testCompile() throws Exception {
XPathOperation operation = (XPathOperation) operations.get(0);

Assert.assertEquals("Invalid event category.", VulnerabilityCaseType.XPATH, operation.getCaseType());
Assert.assertEquals("Invalid executed method name.", XPATHUtils.METHOD_EVALUATE, operation.getMethodName());
Assert.assertEquals("Invalid executed method name.", METHOD_EVALUATE, operation.getMethodName());
Assert.assertEquals("Invalid expression", EXPRESSION, operation.getExpression());
}

Expand All @@ -132,7 +133,7 @@ public void testCompile1() throws Exception {
XPathOperation operation = (XPathOperation) operations.get(0);

Assert.assertEquals("Invalid event category.", VulnerabilityCaseType.XPATH, operation.getCaseType());
Assert.assertEquals("Invalid executed method name.", XPATHUtils.METHOD_EVALUATE, operation.getMethodName());
Assert.assertEquals("Invalid executed method name.", METHOD_EVALUATE, operation.getMethodName());
Assert.assertEquals("Invalid expression", EXPRESSION, operation.getExpression());
}

Expand All @@ -150,7 +151,7 @@ public void testCompile2() throws Exception {
XPathOperation operation = (XPathOperation) operations.get(0);

Assert.assertEquals("Invalid event category.", VulnerabilityCaseType.XPATH, operation.getCaseType());
Assert.assertEquals("Invalid executed method name.", XPATHUtils.METHOD_EVALUATE, operation.getMethodName());
Assert.assertEquals("Invalid executed method name.", METHOD_EVALUATE, operation.getMethodName());
Assert.assertEquals("Invalid expression", EXPRESSION, operation.getExpression());
}

Expand All @@ -168,7 +169,7 @@ public void testCompile3() throws Exception {
XPathOperation operation = (XPathOperation) operations.get(0);

Assert.assertEquals("Invalid event category.", VulnerabilityCaseType.XPATH, operation.getCaseType());
Assert.assertEquals("Invalid executed method name.", XPATHUtils.METHOD_EVALUATE, operation.getMethodName());
Assert.assertEquals("Invalid executed method name.", METHOD_EVALUATE, operation.getMethodName());
Assert.assertEquals("Invalid expression", EXPRESSION, operation.getExpression());
}
}
Loading