@instana/core - npm Package Compare versions

Comparing version 5.3.0 to 5.4.0

package.json

 {
   "name": "@instana/core",
-  "version": "5.3.0",
+  "version": "5.4.0",
   "description": "Core library for Instana's Node.js packages",
@@ -65,4 +65,4 @@ "main": "src/index.js",
     "@opentelemetry/instrumentation-fs": "0.32.0",
-    "@opentelemetry/instrumentation-oracledb": "0.36.0",
-    "@opentelemetry/instrumentation-restify": "0.57.0",
+    "@opentelemetry/instrumentation-oracledb": "0.38.0",
+    "@opentelemetry/instrumentation-restify": "0.58.0",
     "@opentelemetry/instrumentation-socket.io": "0.59.0",
@@ -84,3 +84,3 @@ "@opentelemetry/instrumentation-tedious": "0.28.0",
   },
-  "gitHead": "90a043e1ac3fa122a62d57e9b0bad46038eb31ef"
+  "gitHead": "5f2acd6d957ccc72ccfe51cd53dc28eb4bad0f87"
 }

src/metrics/index.js

@@ -26,3 +26,3 @@ /*
  * valid. Ultimately, it depends on what the backend understands.
- * @typedef {string|Object.<string, any>|Array.<string>} SnapshotOrMetricsPayload
+ * @typedef {Number|string|Object.<string, any>|Array.<string>} SnapshotOrMetricsPayload
  */
@@ -29,0 +29,0 @@

src/tracing/instru...cloud/aws-sdk/v2/instana_aws_product.js

@@ -8,2 +8,4 @@ /*
 
+const tracingUtil = require('../../../../tracingUtil');
+
 class InstanaAWSProduct {
@@ -54,3 +56,3 @@ /**
       if (spanData) {
-        spanData.error = err.message || err.code || JSON.stringify(err);
+        spanData.error = tracingUtil.extractErrorMessage(err);
       }
@@ -57,0 +59,0 @@ }

src/tracing/instru...cloud/aws-sdk/v3/instana_aws_product.js

@@ -8,2 +8,4 @@ /*
 
+const tracingUtil = require('../../../../tracingUtil');
+
 class InstanaAWSProduct {
@@ -53,3 +55,3 @@ /**
       if (span.data?.[this.spanName]) {
-        span.data[this.spanName].error = err.message || err.code || JSON.stringify(err);
+        span.data[this.spanName].error = tracingUtil.extractErrorMessage(err);
       }
@@ -56,0 +58,0 @@ }

src/tracing/instrumentation/databases/couchbase.js

@@ -429,3 +429,3 @@ /*
 
-                  if (result.then && result.catch) {
+                  if (typeof result?.then === 'function' && typeof result?.catch === 'function') {
                     result
@@ -443,2 +443,3 @@ .then(() => {
                   } else {
+                    tracingUtil.handleUnexpectedReturnValue(result, exports.spanName, obj[0].sql);
                     span.cancel();
@@ -493,3 +494,3 @@ }
 
-        if (prom.then && prom.catch) {
+        if (typeof prom?.then === 'function' && typeof prom?.catch === 'function') {
           prom
@@ -511,2 +512,5 @@ .then(result => {
             });
+        } else {
+          tracingUtil.handleUnexpectedReturnValue(prom, exports.spanName, sql);
+          span.cancel();
         }
@@ -513,0 +517,0 @@

src/tracing/instrumentation/databases/db2.js

@@ -331,5 +331,6 @@ /*
         });
-
-      return resultPromise;
+    } else {
+      tracingUtil.handleUnexpectedReturnValue(resultPromise, exports.spanName, 'query');
     }
+    return resultPromise;
   });
@@ -405,2 +406,46 @@ }
 
+  const originalExecuteNonQuery = stmtObject.executeNonQuery;
+
+  stmtObject.executeNonQuery = function instanaExecuteNonQuery() {
+    return cls.ns.runAndReturn(() => {
+      if (!canTrace()) {
+        return originalExecuteNonQuery.apply(this, arguments);
+      }
+
+      const span = createSpan(originalArgs[0], instrumentExecuteHelper, ctx._instanaConnectionString);
+
+      const args = arguments;
+      const origCallbackIndex =
+        // eslint-disable-next-line no-nested-ternary
+        args.length === 1 && typeof args[0] === 'function'
+          ? 0
+          : args.length === 2 && typeof args[1] === 'function'
+          ? 1
+          : null;
+      const origCallback = args[origCallbackIndex];
+
+      if (!origCallback) {
+        // TODO: Instrumentation is currently skipped when no callback is provided.
+        // This behavior needs to be revisited.
+        // Reference: https://jsw.ibm.com/browse/INSTA-80799
+        return originalExecuteNonQuery.apply(this, arguments);
+      }
+
+      args[origCallbackIndex] = function instanaExecuteNonQueryCallback(executeErr) {
+        if (executeErr) {
+          span.ec = 1;
+          tracingUtil.setErrorDetails(span, executeErr, 'db2');
+          finishSpan(ctx, null, span);
+          return origCallback.apply(this, arguments);
+        }
+
+        // NOTE: executeNonQuery returns row count, not a result object
+        finishSpan(ctx, null, span);
+        return origCallback.apply(this, arguments);
+      };
+
+      return originalExecuteNonQuery.apply(this, arguments);
+    });
+  };
+
   const originalExecuteSync = stmtObject.executeSync;
@@ -407,0 +452,0 @@ stmtObject.executeSync = function instanaExecuteSync() {

src/tracing/instrumentation/databases/memcached.js

@@ -140,5 +140,5 @@ /*
     if (span.data?.[SPAN_NAME]) {
-      span.data[SPAN_NAME].error = err.message || err.code || JSON.stringify(err);
+      span.data[SPAN_NAME].error = tracingUtil.extractErrorMessage(err);
     }
   }
 }

src/tracing/instrumentation/databases/mssql.js

@@ -88,6 +88,7 @@ /*
       originalArgs[1] = cls.ns.bind(wrappedCallback);
+      return originalFunction.apply(ctx, originalArgs);
     }
 
     const promise = originalFunction.apply(ctx, originalArgs);
-    if (typeof promise.then === 'function') {
+    if (typeof promise?.then === 'function') {
       promise
@@ -102,2 +103,5 @@ .then(value => {
         });
+    } else {
+      tracingUtil.handleUnexpectedReturnValue(promise, exports.spanName, command);
+      finishSpan(null, span);
     }
@@ -104,0 +108,0 @@ return promise;

src/tracing/instrumentation/databases/mysql.js

@@ -185,16 +185,25 @@ /*
 
-      resultPromise
-        .then(result => {
-          span.d = Date.now() - span.ts;
-          span.transmit();
-          return result;
-        })
-        .catch(error => {
-          span.ec = 1;
-          tracingUtil.setErrorDetails(span, error, exports.spanName);
+      if (typeof resultPromise?.then === 'function') {
+        resultPromise
+          .then(result => {
+            span.d = Date.now() - span.ts;
+            span.transmit();
+            return result;
+          })
+          .catch(error => {
+            span.ec = 1;
+            tracingUtil.setErrorDetails(span, error, exports.spanName);
 
-          span.d = Date.now() - span.ts;
-          span.transmit();
-          return error;
-        });
+            span.d = Date.now() - span.ts;
+            span.transmit();
+            return error;
+          });
+      } else {
+        tracingUtil.handleUnexpectedReturnValue(
+          resultPromise,
+          exports.spanName,
+          typeof statementOrOpts === 'string' ? statementOrOpts : statementOrOpts.sql
+        );
+        onResult();
+      }
       return resultPromise;
@@ -201,0 +210,0 @@ }

src/tracing/instrumentation/databases/prisma.js

@@ -170,3 +170,4 @@ /*
     const requestPromise = originalRequest.apply(ctx, argsForOriginalRequest);
-    if (!requestPromise && typeof requestPromise.then !== 'function') {
+    if (!requestPromise || typeof requestPromise.then !== 'function') {
+      tracingUtil.handleUnexpectedReturnValue(requestPromise, 'prisma', `${params.model}.${params.action}`);
       span.cancel();
@@ -173,0 +174,0 @@ return requestPromise;

src/tracing/instrumentation/databases/redis.js

@@ -514,15 +514,10 @@ /*
 
-        if (err.message) {
-          span.data.redis.error = err.message;
-        } else if (Array.isArray(err) && err.length) {
-          span.data.redis.error = err[0].message;
+        if (Array.isArray(err) && err.length) {
+          span.data.redis.error = tracingUtil.extractErrorMessage(err[0]);
+        } else if (err.errors && err.errors.length) {
+          // v3 = provides sub errors
+          span.data.redis.error = err.errors.map(subErr => tracingUtil.extractErrorMessage(subErr)).join('\n');
         } else {
-          span.data.redis.error = 'Unknown error';
+          span.data.redis.error = tracingUtil.extractErrorMessage(err);
         }
-
-        // v3 = provides sub errors
-        if (err.errors && err.errors.length) {
-          // TODO: Not updating now as special case
-          span.data.redis.error = err.errors.map(subErr => subErr.message).join('\n');
-        }
       }
@@ -529,0 +524,0 @@

src/tracing/instrumentation/frameworks/express.js

@@ -71,3 +71,3 @@ /*
   return function wrappedHandleFn(err) {
-    if (err && err.message && err.stack) {
+    if (err && (err.message || err.cause) && err.stack) {
       annotateHttpEntrySpanWithError(err);
@@ -74,0 +74,0 @@ }

src/tracing/instrumentation/protocols/graphql.js

@@ -302,3 +302,3 @@ /*
   span.d = Date.now() - span.ts;
-  span.data.graphql.errors = err.message;
+  span.data.graphql.errors = tracingUtil.extractErrorMessage(err);
   if (!span.postponeTransmit) {
@@ -305,0 +305,0 @@ span.transmit();

src/tracing/instrumentation/protocols/grpcJs.js

@@ -113,3 +113,3 @@ /*
       if (err) {
-        const errorMessage = err.details || err.message;
+        const errorMessage = tracingUtil.extractErrorMessage(err);
         if (typeof errorMessage === 'string' && errorMessage.toLowerCase().includes('cancelled')) {
@@ -424,3 +424,3 @@ // No-op, we do not want to mark cancelled calls as erroneous.
         span.d = Date.now() - span.ts;
-        const errorMessage = err.details || err.message;
+        const errorMessage = tracingUtil.extractErrorMessage(err);
         if (typeof errorMessage === 'string' && errorMessage.toLowerCase().includes('cancelled')) {
@@ -427,0 +427,0 @@ // No-op, we do not want to mark cancelled calls as erroneous.

src/tracing/instrumentation/protocols/httpClient.js

@@ -301,3 +301,3 @@ /*
       clientRequest.on('error', err => {
-        let errorMessage = err.message || err.code;
+        let errorMessage = tracingUtil.extractErrorMessage(err);
 
@@ -304,0 +304,0 @@ if (isTimeout) {

src/util/url.js

@@ -31,9 +31,14 @@ /*
     }${nullToEmptyString(url.host)}${nullToEmptyString(url.pathname)}`;
-  } catch (e) {
+  } catch {
     // If URL parsing fails and it's a relative URL, return its path.
     // For example, if the input is "/foo?a=b", the returned value will be "/foo".
     if (typeof urlString === 'string' && urlString.startsWith('/')) {
-      return new URL(urlString, 'https://example.org/').pathname;
+      try {
+        return new URL(urlString, 'https://example.org/').pathname;
+      } catch {
+        // Improve sanitization logic (ref: INSTA-747)
+        return urlString;
+      }
     } else {
-      // This case  need adjustment for complete sanitization of the URL, reference 159741
+      // Improve sanitization logic (ref: INSTA-747)
       return urlString;
@@ -40,0 +45,0 @@ }

New alerts

Network access

Supply chain risk

This module accesses the network.

Found 4 instances in 1 package

Debug access

Supply chain risk

Uses debug, reflection and dynamic code execution features.

Found 2 instances in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 30 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Network access

Supply chain risk

This module accesses the network.

Found 4 instances in 1 package

Debug access

Supply chain risk

Uses debug, reflection and dynamic code execution features.

Found 2 instances in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 30 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

905248

0.5%

Lines of code

22445

0.26%

Dependency changes

• + Added

  @opentelemetry/instrumentation-oracledb@0.38.0
  (transitive)

• + Added

  @opentelemetry/instrumentation-restify@0.58.0
  (transitive)

• - Removed

  @opentelemetry/api-logs@0.211.0
  (transitive)

• - Removed

  @opentelemetry/instrumentation@0.211.0
  (transitive)

• - Removed

  @opentelemetry/instrumentation-oracledb@0.36.0
  (transitive)

• - Removed

  @opentelemetry/instrumentation-restify@0.57.0
  (transitive)

• Updated

  @opentelemetry/instrumentation-oracledb@0.38.0

• Updated

  @opentelemetry/instrumentation-restify@0.58.0