API Endpoint Phase 2: Add Endpoint route in Servlet Framework

instrumentation-security/servlet-2.4/src/main/java/com/newrelic/agent/security/instrumentation/servlet24/HttpServletHelper.java

@@ -4,17 +4,21 @@
 import com.newrelic.api.agent.security.instrumentation.helpers.*;
 import com.newrelic.api.agent.security.schema.AgentMetaData;
 import com.newrelic.api.agent.security.schema.ApplicationURLMapping;
+import com.newrelic.api.agent.security.schema.Framework;
 import com.newrelic.api.agent.security.schema.HttpRequest;
+import com.newrelic.api.agent.security.schema.StringUtils;
 import com.newrelic.api.agent.security.schema.policy.AgentPolicy;
 import com.newrelic.api.agent.security.utils.logging.LogLevel;
 
+import javax.servlet.ServletConfig;
 import javax.servlet.ServletContext;
 import javax.servlet.ServletRegistration;
 import javax.servlet.http.HttpServletRequest;
 import java.util.Collection;
 import java.util.Enumeration;
-import java.util.Iterator;
 import java.util.Map;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
 
 public class HttpServletHelper {
 
@@ -154,4 +158,31 @@ else if(path.endsWith(".jsp") || path.endsWith(".jspx") || path.endsWith(".JSP")
             NewRelicSecurity.getAgent().log(LogLevel.WARNING, String.format(GenericHelper.ERROR_WHILE_GETTING_APP_ENDPOINTS, SERVLET_2_4, e.getMessage()), e, HttpServletHelper.class.getName());
         }
     }
+
+    public static void setRoute(HttpServletRequest request, HttpRequest securityRequest, ServletConfig servletConfig) {
+        try {
+            if (URLMappingsHelper.getApplicationURLMappings().isEmpty()){
+                return;
+            }
+            String servletPath = request.getServletPath();
+            if (URLMappingsHelper.getApplicationURLMappings().contains(new ApplicationURLMapping(URLMappingsHelper.WILDCARD, servletPath))) {
+                securityRequest.setRoute(servletPath);
+            } else if (servletConfig != null) {
+                ServletRegistration registration = servletConfig.getServletContext().getServletRegistration(servletConfig.getServletName());
+                if (registration != null && registration.getMappings() != null && !registration.getMappings().isEmpty()) {
+                    for (String mapping : registration.getMappings()) {
+                        Pattern pattern = Pattern.compile(StringUtils.replace(mapping, URLMappingsHelper.WILDCARD, ".*"));
+                        Matcher matcher = pattern.matcher(servletPath);
+                        if (matcher.matches()) {
+                            securityRequest.setRoute(mapping);
+                            break;
+                        }
+                    }
+                }
+            }
+            NewRelicSecurity.getAgent().getSecurityMetaData().getMetaData().setFramework(Framework.SERVLET);
+        } catch (Exception e){
+            NewRelicSecurity.getAgent().log(LogLevel.WARNING, String.format(GenericHelper.ERROR_WHILE_GETTING_ROUTE_FOR_INCOMING_REQUEST, SERVLET_2_4, e.getMessage()), e, HttpServletHelper.class.getName());
+        }
+    }
 }

instrumentation-security/servlet-2.4/src/main/java/javax/servlet/FilterChain_Instrumentation.java

@@ -6,6 +6,7 @@
 import com.newrelic.api.agent.security.instrumentation.helpers.LowSeverityHelper;
 import com.newrelic.api.agent.security.instrumentation.helpers.ServletHelper;
 import com.newrelic.api.agent.security.schema.AgentMetaData;
+import com.newrelic.api.agent.security.schema.Framework;
 import com.newrelic.api.agent.security.schema.HttpRequest;
 import com.newrelic.api.agent.security.schema.SecurityMetaData;
 import com.newrelic.api.agent.security.schema.exceptions.NewRelicSecurityException;
@@ -26,6 +27,9 @@ public abstract class FilterChain_Instrumentation {
 
     public void doFilter(ServletRequest request, ServletResponse response) throws IOException, ServletException {
         boolean isServletLockAcquired = acquireServletLockIfPossible();
+        if (NewRelicSecurity.isHookProcessingActive() && request instanceof HttpServletRequest){
+            HttpServletHelper.setRoute((HttpServletRequest) request, NewRelicSecurity.getAgent().getSecurityMetaData().getRequest(), null);
+        }
         if(isServletLockAcquired) {
             preprocessSecurityHook(request, response);
         }
@@ -68,7 +72,6 @@ private void preprocessSecurityHook(ServletRequest request, ServletResponse resp
             }
 
             HttpServletHelper.processHttpRequestHeader(httpServletRequest, securityRequest);
-
             securityMetaData.setTracingHeaderValue(HttpServletHelper.getTraceHeader(securityRequest.getHeaders()));
 
             securityRequest.setProtocol(httpServletRequest.getScheme());

instrumentation-security/servlet-2.4/src/main/java/javax/servlet/Filter_Instrumentation.java

@@ -6,6 +6,7 @@
 import com.newrelic.api.agent.security.instrumentation.helpers.LowSeverityHelper;
 import com.newrelic.api.agent.security.instrumentation.helpers.ServletHelper;
 import com.newrelic.api.agent.security.schema.AgentMetaData;
+import com.newrelic.api.agent.security.schema.Framework;
 import com.newrelic.api.agent.security.schema.HttpRequest;
 import com.newrelic.api.agent.security.schema.SecurityMetaData;
 import com.newrelic.api.agent.security.schema.exceptions.NewRelicSecurityException;
@@ -28,6 +29,9 @@ public abstract class Filter_Instrumentation {
     public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
             throws IOException, ServletException {
         boolean isServletLockAcquired = acquireServletLockIfPossible();
+        if (NewRelicSecurity.isHookProcessingActive() && request instanceof HttpServletRequest){
+            HttpServletHelper.setRoute((HttpServletRequest) request, NewRelicSecurity.getAgent().getSecurityMetaData().getRequest(), null);
+        }
         if(isServletLockAcquired) {
             preprocessSecurityHook(request, response);
         }

instrumentation-security/servlet-2.4/src/main/java/javax/servlet/Servlet_Instrumentation.java

@@ -32,6 +32,9 @@ public abstract class Servlet_Instrumentation {
 
     public void service(ServletRequest_Instrumentation request, ServletResponse_Instrumentation response) {
         boolean isServletLockAcquired = acquireServletLockIfPossible();
+        if (NewRelicSecurity.isHookProcessingActive() && request instanceof HttpServletRequest){
+            HttpServletHelper.setRoute((HttpServletRequest) request, NewRelicSecurity.getAgent().getSecurityMetaData().getRequest(), getServletConfig());
+        }
         if(isServletLockAcquired) {
             preprocessSecurityHook(request, response);
         }
@@ -140,4 +143,6 @@ private void releaseServletLock() {
             HttpServletHelper.releaseServletLock();
         } catch (Throwable e) {}
     }
+
+    public abstract ServletConfig getServletConfig();
 }

instrumentation-security/servlet-3.0/src/main/java/com/newrelic/agent/security/instrumentation/servlet30/HttpServletHelper.java

@@ -5,12 +5,19 @@
 import com.newrelic.api.agent.security.instrumentation.helpers.GenericHelper;
 import com.newrelic.api.agent.security.instrumentation.helpers.URLMappingsHelper;
 import com.newrelic.api.agent.security.schema.ApplicationURLMapping;
+import com.newrelic.api.agent.security.schema.Framework;
+import com.newrelic.api.agent.security.schema.HttpRequest;
+import com.newrelic.api.agent.security.schema.StringUtils;
 import com.newrelic.api.agent.security.utils.logging.LogLevel;
 
+import javax.servlet.ServletConfig;
 import javax.servlet.ServletContext;
 import javax.servlet.ServletRegistration;
+import javax.servlet.http.HttpServletRequest;
 import java.util.Collection;
 import java.util.Map;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
 
 public class HttpServletHelper {
     private static final String WILDCARD = "*";
@@ -48,4 +55,31 @@ else if(path.endsWith(".jsp") || path.endsWith(".jspx") || path.endsWith(".JSP")
             NewRelicSecurity.getAgent().log(LogLevel.WARNING, String.format(GenericHelper.ERROR_WHILE_GETTING_APP_ENDPOINTS, SERVLET_3_0, e.getMessage()), e, HttpServletHelper.class.getName());
         }
     }
+
+    public static void setRoute(HttpServletRequest request, HttpRequest securityRequest, ServletConfig servletConfig) {
+        try {
+            if (URLMappingsHelper.getApplicationURLMappings().isEmpty()){
+                return;
+            }
+            String servletPath = request.getServletPath();
+            if (URLMappingsHelper.getApplicationURLMappings().contains(new ApplicationURLMapping(URLMappingsHelper.WILDCARD, servletPath))) {
+                securityRequest.setRoute(servletPath);
+            } else if (servletConfig != null) {
+                ServletRegistration registration = servletConfig.getServletContext().getServletRegistration(servletConfig.getServletName());
+                if (registration != null && registration.getMappings() != null && !registration.getMappings().isEmpty()) {
+                    for (String mapping : registration.getMappings()) {
+                        Pattern pattern = Pattern.compile(StringUtils.replace(mapping, URLMappingsHelper.WILDCARD, ".*"));
+                        Matcher matcher = pattern.matcher(servletPath);
+                        if (matcher.matches()) {
+                            securityRequest.setRoute(mapping);
+                            break;
+                        }
+                    }
+                }
+            }
+            NewRelicSecurity.getAgent().getSecurityMetaData().getMetaData().setFramework(Framework.SERVLET);
+        } catch (Exception e){
+            NewRelicSecurity.getAgent().log(LogLevel.WARNING, String.format(GenericHelper.ERROR_WHILE_GETTING_ROUTE_FOR_INCOMING_REQUEST, SERVLET_3_0, e.getMessage()), e, HttpServletHelper.class.getName());
+        }
+    }
 }

instrumentation-security/servlet-3.0/src/main/java/javax/servlet/Servlet_Instrumentation.java

@@ -0,0 +1,24 @@
+package javax.servlet;
+
+import com.newrelic.agent.security.instrumentation.servlet30.HttpServletHelper;
+import com.newrelic.api.agent.security.NewRelicSecurity;
+import com.newrelic.api.agent.security.schema.SecurityMetaData;
+import com.newrelic.api.agent.weaver.MatchType;
+import com.newrelic.api.agent.weaver.Weave;
+import com.newrelic.api.agent.weaver.Weaver;
+
+import javax.servlet.http.HttpServletRequest;
+
+@Weave(type = MatchType.Interface, originalName = "javax.servlet.Servlet")
+public abstract class Servlet_Instrumentation {
+
+    public void service(ServletRequest req, ServletResponse res){
+        if (NewRelicSecurity.isHookProcessingActive() && req instanceof HttpServletRequest){
+            HttpServletHelper.setRoute((HttpServletRequest) req, NewRelicSecurity.getAgent().getSecurityMetaData().getRequest(), getServletConfig());
+        }
+        Weaver.callOriginal();
+    }
+
+    public abstract ServletConfig getServletConfig();
+
+}

instrumentation-security/servlet-3.0/src/test/java/com/nr/agent/security/instrumentation/servlet30/ApiEndpointTest.java

@@ -2,14 +2,20 @@
 
 import com.newrelic.agent.security.introspec.InstrumentationTestConfig;
 import com.newrelic.agent.security.introspec.SecurityInstrumentationTestRunner;
+import com.newrelic.api.agent.Trace;
 import com.newrelic.api.agent.security.instrumentation.helpers.URLMappingsHelper;
 import com.newrelic.api.agent.security.schema.ApplicationURLMapping;
-import org.apache.catalina.servlets.DefaultServlet;
+import com.newrelic.api.agent.security.schema.Framework;
+import com.newrelic.api.agent.security.schema.SecurityMetaData;
 import org.junit.Assert;
 import org.junit.ClassRule;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 
+import java.io.IOException;
+import java.net.HttpURLConnection;
+import java.net.URISyntaxException;
+import java.net.URL;
 import java.util.Iterator;
 
 @RunWith(SecurityInstrumentationTestRunner.class)
@@ -32,4 +38,21 @@ public void testURLMappings() {
         ApplicationURLMapping mapping2 = mappings.next();
         Assert.assertEquals("URL Mappings", new ApplicationURLMapping(method, "/test", handler), mapping2);
     }
+
+    @Test
+    public void testRoute() throws IOException, URISyntaxException {
+        connect();
+        SecurityMetaData metaData = SecurityInstrumentationTestRunner.getIntrospector().getSecurityMetaData();
+        Assert.assertEquals( "Incorrect Route Detected","/test", metaData.getRequest().getRoute());
+        Assert.assertEquals("Incorrect Framework detected", Framework.SERVLET.name(), metaData.getMetaData().getFramework());
+    }
+
+    @Trace(dispatcher = true)
+    private void connect() throws IOException, URISyntaxException {
+        URL u = server.getEndPoint().toURL();
+        HttpURLConnection conn = (HttpURLConnection) u.openConnection();
+        conn.setRequestProperty("content-type", "text/plain; charset=utf-8");
+        conn.connect();
+        conn.getResponseCode();
+    }
 }

instrumentation-security/servlet-3.0/src/test/java/com/nr/agent/security/instrumentation/servlet30/HttpServletServer.java

@@ -3,7 +3,6 @@
 import org.apache.catalina.Context;
 import org.apache.catalina.LifecycleState;
 import org.apache.catalina.connector.Connector;
-import org.apache.catalina.servlets.DefaultServlet;
 import org.apache.catalina.startup.Tomcat;
 import org.apache.catalina.webresources.TomcatURLStreamHandlerFactory;
 import org.apache.tomcat.util.http.fileupload.FileUtils;
@@ -19,6 +18,8 @@
 import java.io.File;
 import java.io.IOException;
 import java.net.ServerSocket;
+import java.net.URI;
+import java.net.URISyntaxException;
 import java.util.Collections;
 import java.util.Set;
 
@@ -91,6 +92,10 @@ private void stop() {
             }
         }
     }
+
+    public URI getEndPoint() throws URISyntaxException {
+        return new URI("http://localhost:" + port + "/test");
+    }
 }
 class MyServlet extends HttpServlet {
     @Override

instrumentation-security/servlet-5.0/src/main/java/com/newrelic/agent/security/instrumentation/servlet5/HttpServletHelper.java

@@ -4,16 +4,17 @@
 import com.newrelic.api.agent.security.instrumentation.helpers.*;
 import com.newrelic.api.agent.security.schema.AgentMetaData;
 import com.newrelic.api.agent.security.schema.ApplicationURLMapping;
+import com.newrelic.api.agent.security.schema.Framework;
 import com.newrelic.api.agent.security.schema.HttpRequest;
 import com.newrelic.api.agent.security.schema.policy.AgentPolicy;
 import com.newrelic.api.agent.security.utils.logging.LogLevel;
 import jakarta.servlet.ServletContext;
 import jakarta.servlet.ServletRegistration;
+import jakarta.servlet.http.HttpServletMapping;
 import jakarta.servlet.http.HttpServletRequest;
 
 import java.util.Collection;
 import java.util.Enumeration;
-import java.util.Iterator;
 import java.util.Map;
 
 public class HttpServletHelper {
@@ -154,4 +155,19 @@ else if(path.endsWith(".jsp") || path.endsWith(".jspx") || path.endsWith(".JSP")
             NewRelicSecurity.getAgent().log(LogLevel.WARNING, String.format(GenericHelper.ERROR_WHILE_GETTING_APP_ENDPOINTS, SERVLET_5_0, e.getMessage()), e, HttpServletHelper.class.getName());
         }
     }
+
+    public static void setRoute(HttpServletRequest request){
+        try {
+            if (!NewRelicSecurity.isHookProcessingActive() || URLMappingsHelper.getApplicationURLMappings().isEmpty() || (!NewRelicSecurity.getAgent().getSecurityMetaData().getMetaData().getFramework().isEmpty() && !NewRelicSecurity.getAgent().getSecurityMetaData().getMetaData().getFramework().equals(Framework.SERVLET.name()))){
+                return;
+            }
+            HttpServletMapping mapping = request.getHttpServletMapping();
+            if (mapping != null) {
+                NewRelicSecurity.getAgent().getSecurityMetaData().getRequest().setRoute(mapping.getPattern());
+            }
+            NewRelicSecurity.getAgent().getSecurityMetaData().getMetaData().setFramework(Framework.SERVLET);
+        } catch (Exception e){
+            NewRelicSecurity.getAgent().log(LogLevel.WARNING, String.format(GenericHelper.ERROR_WHILE_GETTING_ROUTE_FOR_INCOMING_REQUEST, SERVLET_5_0, e.getMessage()), e, HttpServletHelper.class.getName());
+        }
+    }
 }

instrumentation-security/servlet-5.0/src/main/java/jakarta/servlet/FilterChain_Instrumentation.java

@@ -26,6 +26,9 @@ public abstract class FilterChain_Instrumentation {
 
     public void doFilter(ServletRequest request, ServletResponse response) throws IOException, ServletException {
         boolean isServletLockAcquired = acquireServletLockIfPossible();
+        if (request instanceof HttpServletRequest) {
+            HttpServletHelper.setRoute((HttpServletRequest)request);
+        }
         if(isServletLockAcquired) {
             preprocessSecurityHook(request, response);
         }

instrumentation-security/servlet-5.0/src/main/java/jakarta/servlet/Filter_Instrumentation.java

@@ -27,6 +27,9 @@ public abstract class Filter_Instrumentation {
     public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
             throws IOException, ServletException {
         boolean isServletLockAcquired = acquireServletLockIfPossible();
+        if (request instanceof HttpServletRequest) {
+            HttpServletHelper.setRoute((HttpServletRequest)request);
+        }
         if(isServletLockAcquired) {
             preprocessSecurityHook(request, response);
         }

instrumentation-security/servlet-5.0/src/main/java/jakarta/servlet/Servlet_Instrumentation.java

@@ -32,6 +32,9 @@ public abstract class Servlet_Instrumentation {
 
     public void service(ServletRequest_Instrumentation request, ServletResponse_Instrumentation response) {
         boolean isServletLockAcquired = acquireServletLockIfPossible();
+        if (request instanceof HttpServletRequest) {
+            HttpServletHelper.setRoute((HttpServletRequest)request);
+        }
         if(isServletLockAcquired) {
             preprocessSecurityHook(request, response);
         }

instrumentation-security/servlet-5.0/src/test/java/com/nr/agent/security/instrumentation/servlet5/HttpServletTest.java

@@ -32,6 +32,8 @@ public void testPost() throws Exception {
         AgentMetaData metaData = introspector.getSecurityMetaData().getMetaData();
         Assert.assertTrue(metaData.isUserLevelServiceMethodEncountered());
         Assert.assertNotNull(metaData.getServiceTrace());
+        Assert.assertEquals("Incorrect route detected", "/*", introspector.getSecurityMetaData().getRequest().getRoute());
+
     }
     @Test
     public void testDelete() throws Exception {
@@ -41,6 +43,8 @@ public void testDelete() throws Exception {
         AgentMetaData metaData = introspector.getSecurityMetaData().getMetaData();
         Assert.assertTrue(metaData.isUserLevelServiceMethodEncountered());
         Assert.assertNotNull(metaData.getServiceTrace());
+
+        Assert.assertEquals("Incorrect route detected", "/*", introspector.getSecurityMetaData().getRequest().getRoute());
     }
     @Test
     public void testPUT() throws Exception {
@@ -50,6 +54,8 @@ public void testPUT() throws Exception {
         AgentMetaData metaData = introspector.getSecurityMetaData().getMetaData();
         Assert.assertTrue(metaData.isUserLevelServiceMethodEncountered());
         Assert.assertNotNull(metaData.getServiceTrace());
+
+        Assert.assertEquals("Incorrect route detected", "/*", introspector.getSecurityMetaData().getRequest().getRoute());
     }
 
     @Test
@@ -60,6 +66,8 @@ public void testHEAD() throws Exception {
         AgentMetaData metaData = introspector.getSecurityMetaData().getMetaData();
         Assert.assertTrue(metaData.isUserLevelServiceMethodEncountered());
         Assert.assertNotNull(metaData.getServiceTrace());
+
+        Assert.assertEquals("Incorrect route detected", "/*", introspector.getSecurityMetaData().getRequest().getRoute());
     }
     @Test
     public void testGET() throws Exception {
@@ -69,6 +77,8 @@ public void testGET() throws Exception {
         AgentMetaData metaData = introspector.getSecurityMetaData().getMetaData();
         Assert.assertTrue(metaData.isUserLevelServiceMethodEncountered());
         Assert.assertNotNull(metaData.getServiceTrace());
+
+        Assert.assertEquals("Incorrect route detected", "/*", introspector.getSecurityMetaData().getRequest().getRoute());
     }
 
     @Trace(dispatcher = true)