@instana/core - npm Package Compare versions

Comparing version 1.75.0 to 1.76.0

package.json

 {
   "name": "@instana/core",
-  "version": "1.75.0",
+  "version": "1.76.0",
   "description": "Core library for Instana's Node.js packages",
@@ -135,3 +135,3 @@ "main": "src/index.js",
   },
-  "gitHead": "d127eb54c91c658eca2a390a10ff6cda6d5f679b"
+  "gitHead": "24579c129b79a1b9cf11137f20b68d5a7bee6a79"
 }

src/index.js

@@ -26,2 +26,3 @@ 'use strict';
   log.init(config);
+  exports.util.hasThePackageBeenInitializedTooLate();
   config = normalizeConfig(config);
@@ -28,0 +29,0 @@ exports.secrets.init(config);

src/tracing/index.js

@@ -31,2 +31,3 @@ 'use strict';
   './instrumentation/database/redis',
+  './instrumentation/frameworks/awsSdk',
   './instrumentation/frameworks/express',
@@ -33,0 +34,0 @@ './instrumentation/frameworks/fastify',

src/tracing/instrumentation/protocols/httpClient.js

@@ -268,2 +268,5 @@ 'use strict';
   if (hasHeadersOption(options)) {
+    if (!isItSafeToModifiyHeadersInOptions(options)) {
+      return true;
+    }
     options.headers[constants.spanIdHeaderName] = span.s;
@@ -279,2 +282,5 @@ options.headers[constants.traceIdHeaderName] = span.t;
   if (hasHeadersOption(options)) {
+    if (!isItSafeToModifiyHeadersInOptions(options)) {
+      return true;
+    }
     options.headers[constants.traceLevelHeaderName] = level;
@@ -291,8 +297,44 @@ return true;
 function setHeadersOnRequest(clientRequest, span) {
+  if (!isItSafeToModifiyHeadersForRequest(clientRequest)) {
+    return;
+  }
   clientRequest.setHeader(constants.spanIdHeaderName, span.s);
   clientRequest.setHeader(constants.traceIdHeaderName, span.t);
   clientRequest.setHeader(constants.traceLevelHeaderName, '1');
+}
+
+function isItSafeToModifiyHeadersInOptions(options) {
+  var keys = Object.keys(options.headers);
+  var key;
+  for (var i = 0; i < keys.length; i++) {
+    key = keys[i];
+    if (
+      'authorization' === key.toLowerCase() &&
+      typeof options.headers[key] === 'string' &&
+      options.headers[key].indexOf('AWS') === 0
+    ) {
+      // This is a signed AWS API request (probably from the aws-sdk package).
+      // Adding our headers too this request would trigger a SignatureDoesNotMatch error in case the request will be
+      // retried:
+      // "SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided.
+      // Check your key and signing method."
+      // See https://docs.aws.amazon.com/general/latest/gr/signing_aws_api_requests.html
+      //
+      // Additionally, adding our headers to this request would not have any benefit - the receiving end will be an AWS
+      // service like S3 and those are not instrumented. (There is a very small chance that the receiving end is an
+      // instrumented Lambda function behind an API gateway and the user is using
+      // https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/APIGateway.html to invoke this Gateway/Lambda
+      // combination, which _would_ benefit from tracing headers.)
+      return false;
+    }
+  }
   return true;
 }
 
+function isItSafeToModifiyHeadersForRequest(clientRequest) {
+  var authHeader = clientRequest.getHeader('Authorization');
+  // see comment in isItSafeToModifiyHeadersInOptions
+  return !authHeader || authHeader.indexOf('AWS') !== 0;
+}
+
 function splitAndFilter(fullUrl) {
@@ -299,0 +341,0 @@ var parts = fullUrl.split('?');

src/util/index.js

@@ -9,2 +9,3 @@ 'use strict';
   compression: require('./compression'),
+  hasThePackageBeenInitializedTooLate: require('./initializedTooLateHeuristic'),
   propertySizes: require('./propertySizes'),
@@ -11,0 +12,0 @@ requireHook: require('./requireHook'),

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

287402

increased by16.86%

Number of package files

71

increased by5.97%

Lines of code

7039

increased by1.66%

No dependency changes