Skip to content

Commit 498b8f3

Browse files
lavarouhahuja2bduranleau-nrzsistlamfulb
authored
feat(agent): use composer for vuln mgmt package info (#962)
If possible, use Composer's runtime API to collect information about PHP packages used by the application for New Relic Vulnerability Management. This feature is disabled by default and can be enabled by setting `newrelic.vulnerability_management.composer_detection.enabled` to `true`. --------- Co-authored-by: Hitesh Ahuja <[email protected]> Co-authored-by: bduranleau-nr <[email protected]> Co-authored-by: Hitesh Ahuja <[email protected]> Co-authored-by: Amber Sistla <[email protected]> Co-authored-by: Michael Fulbright <[email protected]>
1 parent f4a33d2 commit 498b8f3

File tree

126 files changed

+2972
-235
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

126 files changed

+2972
-235
lines changed

‎agent/Makefile.frag

+1
Original file line numberDiff line numberDiff line change
@@ -107,6 +107,7 @@ TEST_BINARIES = \
107107
tests/test_php_minit \
108108
tests/test_php_stack \
109109
tests/test_php_stacked_segment \
110+
tests/test_php_txn \
110111
tests/test_php_wrapper \
111112
tests/test_predis \
112113
tests/test_redis \

‎agent/config.m4

+2-1
Original file line numberDiff line numberDiff line change
@@ -230,7 +230,8 @@ if test "$PHP_NEWRELIC" = "yes"; then
230230
fw_zend2.c fw_zend.c"
231231
LIBRARIES="lib_aws_sdk_php.c lib_monolog.c lib_doctrine2.c lib_guzzle3.c \
232232
lib_guzzle4.c lib_guzzle6.c lib_guzzle_common.c \
233-
lib_mongodb.c lib_phpunit.c lib_predis.c lib_zend_http.c"
233+
lib_mongodb.c lib_phpunit.c lib_predis.c lib_zend_http.c \
234+
lib_composer.c"
234235
PHP_NEW_EXTENSION(newrelic, $FRAMEWORKS $LIBRARIES $NEWRELIC_AGENT, $ext_shared,, \\$(NEWRELIC_CFLAGS))
235236

236237
PHP_SUBST(NEWRELIC_CFLAGS)

‎agent/fw_drupal.c

+10
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,8 @@
2020
#include "util_memory.h"
2121
#include "util_strings.h"
2222

23+
#define PHP_PACKAGE_NAME "drupal/drupal"
24+
2325
/*
2426
* Set the Web Transaction (WT) name to "(cached page)"
2527
*
@@ -879,4 +881,12 @@ void nr_drupal_enable(TSRMLS_D) {
879881
nr_php_user_function_add_declared_callback(
880882
NR_PSTR("drupal_http_request"), nr_drupal_replace_http_request TSRMLS_CC);
881883
#endif
884+
885+
if (NRINI(vulnerability_management_package_detection_enabled)) {
886+
nr_txn_add_php_package(NRPRG(txn), PHP_PACKAGE_NAME,
887+
PHP_PACKAGE_VERSION_UNKNOWN);
888+
}
889+
890+
nr_txn_suggest_package_supportability_metric(NRPRG(txn), PHP_PACKAGE_NAME,
891+
PHP_PACKAGE_VERSION_UNKNOWN);
882892
}

‎agent/fw_drupal8.c

+3-2
Original file line numberDiff line numberDiff line change
@@ -689,8 +689,6 @@ void nr_drupal_version() {
689689
if (NRINI(vulnerability_management_package_detection_enabled)) {
690690
nr_txn_add_php_package(NRPRG(txn), PHP_PACKAGE_NAME, version);
691691
}
692-
nr_fw_support_add_package_supportability_metric(NRPRG(txn), PHP_PACKAGE_NAME,
693-
version);
694692
}
695693

696694
nr_php_zval_free(&zval_version);
@@ -762,4 +760,7 @@ void nr_drupal8_enable(TSRMLS_D) {
762760
nr_txn_add_php_package(NRPRG(txn), PHP_PACKAGE_NAME,
763761
PHP_PACKAGE_VERSION_UNKNOWN);
764762
}
763+
764+
nr_txn_suggest_package_supportability_metric(NRPRG(txn), PHP_PACKAGE_NAME,
765+
PHP_PACKAGE_VERSION_UNKNOWN);
765766
}

‎agent/fw_hooks.h

+1
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ extern void nr_phpunit_enable(TSRMLS_D);
5656
extern void nr_predis_enable(TSRMLS_D);
5757
extern void nr_zend_http_enable(TSRMLS_D);
5858
extern void nr_monolog_enable(TSRMLS_D);
59+
extern void nr_composer_handle_autoload(const char* filename);
5960

6061
/* Vulnerability Management Packages */
6162
extern void nr_drupal_version(void);

‎agent/fw_laminas3.c

+6-1
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@
1313
#include "util_logging.h"
1414
#include "util_memory.h"
1515

16+
#define PHP_PACKAGE_NAME "laminas/laminas-mvc"
17+
1618
/*
1719
* Laminas is a rebranding of Zend, but the logic remains the same,
1820
* it is simply a name change and corresponds directly to Zend 3.x.
@@ -163,7 +165,10 @@ void nr_laminas3_enable(TSRMLS_D) {
163165
nr_laminas3_name_the_wt TSRMLS_CC);
164166

165167
if (NRINI(vulnerability_management_package_detection_enabled)) {
166-
nr_txn_add_php_package(NRPRG(txn), "laminas/laminas-mvc",
168+
nr_txn_add_php_package(NRPRG(txn), PHP_PACKAGE_NAME,
167169
PHP_PACKAGE_VERSION_UNKNOWN);
168170
}
171+
172+
nr_txn_suggest_package_supportability_metric(NRPRG(txn), PHP_PACKAGE_NAME,
173+
PHP_PACKAGE_VERSION_UNKNOWN);
169174
}

‎agent/fw_laravel.c

+3-2
Original file line numberDiff line numberDiff line change
@@ -963,8 +963,9 @@ NR_PHP_WRAPPER(nr_laravel_application_construct) {
963963
// Add php package to transaction
964964
nr_txn_add_php_package(NRPRG(txn), PHP_PACKAGE_NAME, version);
965965
}
966-
nr_fw_support_add_package_supportability_metric(NRPRG(txn), PHP_PACKAGE_NAME,
967-
version);
966+
967+
nr_txn_suggest_package_supportability_metric(NRPRG(txn), PHP_PACKAGE_NAME,
968+
version);
968969

969970
if (version) {
970971
nrl_debug(NRL_FRAMEWORK, "Laravel version is " NRP_FMT, NRP_PHP(version));

‎agent/fw_lumen.c

+7-1
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,13 @@
1111
#include "php_wrapper.h"
1212
#include "php_hash.h"
1313
#include "fw_hooks.h"
14+
#include "fw_support.h"
1415
#include "util_logging.h"
1516
#include "util_memory.h"
1617
#include "util_strings.h"
1718

19+
#define PHP_PACKAGE_NAME "laravel/lumen-framework"
20+
1821
/*
1922
* Sets the web transaction name. If strip_base == true,
2023
* leading class path components will be stripped.
@@ -232,7 +235,10 @@ void nr_lumen_enable(TSRMLS_D) {
232235
#endif
233236

234237
if (NRINI(vulnerability_management_package_detection_enabled)) {
235-
nr_txn_add_php_package(NRPRG(txn), "laravel/lumen-framework",
238+
nr_txn_add_php_package(NRPRG(txn), PHP_PACKAGE_NAME,
236239
PHP_PACKAGE_VERSION_UNKNOWN);
237240
}
241+
242+
nr_txn_suggest_package_supportability_metric(NRPRG(txn), PHP_PACKAGE_NAME,
243+
PHP_PACKAGE_VERSION_UNKNOWN);
238244
}

‎agent/fw_slim.c

+2-2
Original file line numberDiff line numberDiff line change
@@ -163,8 +163,8 @@ NR_PHP_WRAPPER(nr_slim_application_construct) {
163163
nr_txn_add_php_package(NRPRG(txn), PHP_PACKAGE_NAME, version);
164164
}
165165

166-
nr_fw_support_add_package_supportability_metric(NRPRG(txn), PHP_PACKAGE_NAME,
167-
version);
166+
nr_txn_suggest_package_supportability_metric(NRPRG(txn), PHP_PACKAGE_NAME,
167+
version);
168168

169169
nr_free(version);
170170
nr_php_scope_release(&this_var);

‎agent/fw_support.c

+21-5
Original file line numberDiff line numberDiff line change
@@ -58,23 +58,39 @@ void nr_fw_support_add_logging_supportability_metric(nrtxn_t* txn,
5858
void nr_fw_support_add_package_supportability_metric(
5959
nrtxn_t* txn,
6060
const char* package_name,
61-
const char* package_version) {
62-
if (NULL == txn || NULL == package_name || NULL == package_version) {
61+
const char* package_version,
62+
nr_php_package_t* p) {
63+
if (NULL == txn || NULL == package_name) {
6364
return;
6465
}
6566

6667
char* metname = NULL;
6768
char major_version[MAJOR_VERSION_LENGTH] = {0};
69+
const char* version = package_version;
70+
71+
// override provided package_version only if:
72+
// - php_package is provided
73+
// - its version is not NULL
74+
// - its version is not PHP_PACKAGE_VERSION_UNKNOWN
75+
if (NULL != p && NULL != p->package_version
76+
&& 0 != nr_strcmp(p->package_version, PHP_PACKAGE_VERSION_UNKNOWN)) {
77+
version = p->package_version;
78+
}
79+
80+
// only generate metric if version is known
81+
if (NULL == version || 0 == nr_strcmp(version, PHP_PACKAGE_VERSION_UNKNOWN)) {
82+
return;
83+
}
6884

6985
/* The below for loop checks if the major version of the package is more than
7086
* one digit and keeps looping until a '.' is encountered or one of the
7187
* conditions is met.
7288
*/
73-
for (int i = 0; package_version[i] && i < MAJOR_VERSION_LENGTH - 1; i++) {
74-
if ('.' == package_version[i]) {
89+
for (int i = 0; version[i] && i < MAJOR_VERSION_LENGTH - 1; i++) {
90+
if ('.' == version[i]) {
7591
break;
7692
}
77-
major_version[i] = package_version[i];
93+
major_version[i] = version[i];
7894
}
7995

8096
if (NR_FW_UNSET == NRINI(force_framework)) {

‎agent/fw_support.h

+4-1
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
#define FW_SUPPORT_HDR
99

1010
#include "php_user_instrument.h"
11+
#include "nr_php_packages.h"
1112

1213
extern void nr_php_framework_add_supportability_metric(
1314
const char* framework_name,
@@ -44,11 +45,13 @@ extern void nr_fw_support_add_logging_supportability_metric(
4445
* Params : 1. Transaction object
4546
* 2. Package name
4647
* 3. Package version
48+
* 4. PHP package reported for vulnerability management
4749
*
4850
*/
4951
extern void nr_fw_support_add_package_supportability_metric(
5052
nrtxn_t* txn,
5153
const char* package_name,
52-
const char* package_version);
54+
const char* package_version,
55+
nr_php_package_t* p);
5356

5457
#endif /* FW_SUPPORT_HDR */

‎agent/fw_symfony4.c

+6-1
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@
1010
#include "fw_support.h"
1111
#include "fw_symfony_common.h"
1212

13+
#define PHP_PACKAGE_NAME "symfony/http-kernel"
14+
1315
NR_PHP_WRAPPER(nr_symfony4_exception) {
1416
int priority = nr_php_error_get_priority(E_ERROR);
1517
zval* event = NULL;
@@ -277,7 +279,10 @@ void nr_symfony4_enable(TSRMLS_D) {
277279
#endif
278280

279281
if (NRINI(vulnerability_management_package_detection_enabled)) {
280-
nr_txn_add_php_package(NRPRG(txn), "symfony/http-kernel",
282+
nr_txn_add_php_package(NRPRG(txn), PHP_PACKAGE_NAME,
281283
PHP_PACKAGE_VERSION_UNKNOWN);
282284
}
285+
286+
nr_txn_suggest_package_supportability_metric(NRPRG(txn), PHP_PACKAGE_NAME,
287+
PHP_PACKAGE_VERSION_UNKNOWN);
283288
}

‎agent/fw_wordpress.c

+4-4
Original file line numberDiff line numberDiff line change
@@ -804,17 +804,17 @@ void nr_wordpress_version() {
804804
"})();";
805805

806806
zval retval;
807-
int result
808-
= zend_eval_string(func_string, &retval, "Get Wordpress Version");
807+
int result = zend_eval_string(func_string, &retval, "Get Wordpress Version");
809808
// Add php package to transaction
810809
if (SUCCESS == result) {
811810
if (nr_php_is_zval_valid_string(&retval)) {
812811
char* version = Z_STRVAL(retval);
813812
if (NRINI(vulnerability_management_package_detection_enabled)) {
814813
nr_txn_add_php_package(NRPRG(txn), PHP_PACKAGE_NAME, version);
815814
}
816-
nr_fw_support_add_package_supportability_metric(NRPRG(txn), PHP_PACKAGE_NAME,
817-
version);
815+
816+
nr_txn_suggest_package_supportability_metric(NRPRG(txn), PHP_PACKAGE_NAME,
817+
version);
818818
}
819819
zval_dtor(&retval);
820820
}

‎agent/fw_yii.c

+9
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
#include "util_memory.h"
1515
#include "util_strings.h"
1616

17+
#define PHP_PACKAGE_NAME "yiisoft/yii2"
1718
/*
1819
* Yii1: Set the web transaction name from the controllerId + actionId combo.
1920
*
@@ -221,4 +222,12 @@ void nr_yii2_enable(TSRMLS_D) {
221222
nr_php_wrap_user_function(NR_PSTR("yii\\base\\ErrorHandler::logException"),
222223
nr_yii2_error_handler_wrapper TSRMLS_CC);
223224
#endif
225+
226+
if (NRINI(vulnerability_management_package_detection_enabled)) {
227+
nr_txn_add_php_package(NRPRG(txn), PHP_PACKAGE_NAME,
228+
PHP_PACKAGE_VERSION_UNKNOWN);
229+
}
230+
231+
nr_txn_suggest_package_supportability_metric(NRPRG(txn), PHP_PACKAGE_NAME,
232+
PHP_PACKAGE_VERSION_UNKNOWN);
224233
}

‎agent/lib_aws_sdk_php.c

+4-2
Original file line numberDiff line numberDiff line change
@@ -69,8 +69,10 @@ void nr_lib_aws_sdk_php_handle_version() {
6969
/* Add php package to transaction */
7070
nr_txn_add_php_package(NRPRG(txn), PHP_PACKAGE_NAME, version);
7171
}
72-
nr_fw_support_add_package_supportability_metric(NRPRG(txn), PHP_PACKAGE_NAME,
73-
version);
72+
73+
nr_txn_suggest_package_supportability_metric(NRPRG(txn), PHP_PACKAGE_NAME,
74+
version);
75+
7476
nr_php_zval_free(&zval_version);
7577
}
7678

0 commit comments

Comments
 (0)