v1.0.6

Update version to 1.0.6

v1.0.3

Fix

• IP headers parsing with IPv6 addresses:
  Fix the parsing of IP headers such as X-Forwarded-For in presence of IPv6
  addresses. IPv6 addresses were mistakenly split by host and port number, later
  leading to IP parsing issues and thus ignoring the address.

v1.0.2

Fix

• Configuration:
  Use the configuration key proxy both as an HTTP and HTTPS proxy setting.

• sdk/sqreen-instrumentation-tool:
  Fix filepath generation on Windows.

v1.0.1

Fix

• Fix Sqreen's overhead rate calculation when the observed execution time is 0.
  This situation can happen when the execution timer wasn't precise enough in
  order to observe fast execution times.

Internal Changes

• Add a new backend url configuration key ingestion_url for validation
  testing.

v1.0.0

New Features

• (#172) New SDK convenience function:
  Add a new helper function sdk.FromRequest() allowing to retrieve Sqreen's request context and perform SDK calls. It is equivalent to sdk.FromContext(r.Context()).

• (#156) Performance monitoring:
  Monitor the execution time of requests protected by Sqreen. Optionally, it is possible to enforce the maximum amount of time Sqreen is allowed to run per request: Sqreen's monitoring and protections will only run for the given amount of time. This option is disabled by default and should be used with caution as it can lead to partially protected requests.
  The resulting performance monitoring diagrams and settings are available at https://my.sqreen.com/application/goto/settings/performance.
  Note that the execution time diagram cannot be used as a strict Application Performance Monitoring diagram as it is based on a lossy representation. It gives rough estimates of the actual execution time.

• (#170) Transparent response writer instrumentation:
  Make the HTTP response writer instrumentation transparent by providing the same set of interfaces as the instrumented HTTP response writer. The set of interfaces is currently every optional net/http response writer interface, along with some relevant io interfaces, among which:

  • http.Flusher: for HTTP streaming support (multipart, chunked...).
  • http.Pusher: for HTTP2 server push support.
  • http.Hijacker: for websocket server support (experimental).
  • io.ReaderFrom: for optimized copies (eg. file copies).
  • io.WriteString: for optimized string copies.

• (#163) HTTP status code 404 (not found) monitoring:
  Automatically log a security event when the response status code is 404. This event is used by an internal Sqreen backend playbook to detect security scans.

• (#163) Scalable security event throughput:
  To be able to handle a higher throughput of security events, the agent can now scale its number of goroutines. An extra goroutine is created every time the internal event queue is full, up to the number of available CPUs. Note that the agent still drops security events when the event queue is full in order to avoid slowing down the host application.

• (#165) Agent errors in the request hot-path:
  To avoid slowing down request handlers, agent errors happening in the request hot path are now logged based on an exponential backoff algorithm.
  This is disabled when the agent log level is debug.

Breaking Change

• (#168) SDK return values:
  The SDK function and method return values are no longer pointer values but Go interface values. This may break integrations using explicit SDK return types, and we recommend to instead use type-inference when possible. This change will allow us to transparently change the actual return values without involving any further breaking change.
  As of today, the actual return value is a structure small enough to be returned by value in order to save memory-allocation and garbage-collection time. Returning an interface value allows to hide such implementation detail.

Fixes

• (#167) Playbook security response events:
  Fix playbook security response events (blocking or redirecting a user or ip) so that Sqreen's dashboard can properly display them and link them to their source playbook.

• (#169) SQL-injection protection with Elastic APM:
  Fix the detection of the SQL dialect when the SQL driver is instrumented by Elastic's APM tracer. This requires Elastic's Go agent version greater than v1.9.0.

• (#164) Echo middleware:
  Fix the response status code monitoring when Echo's request handlers return an error.

• (#166) Gin middleware:
  Fix the response content-length monitoring of default responses (ie. when the handler does nothing).

v0.16.1

Fixes

• (#158) PII: make the PII scrubbing of In-App WAF attack events case-insensitive in order to correctly scrub transformed request parameters.

• (#159) Monitoring: fix the content type and length monitoring of HTTP responses.

• (#157) Gin middleware: use the request Go context instead of Gin's so that the agent can properly manage the request execution context, but also to correctly propagate values stored in the Go context before the middleware function.

v0.16.0

New Features

• (#155) Add Echo v4 support with a new middleware function provided by package github.com/sqreen/go-agent/sdk/middleware/sqecho/v4.

• (#152) Add In-App WAF protection to Echo's request parameter parser: Context's method Bind() is now protected by the In-App WAF. The Go value it parses from the HTTP request is made available to the In-App WAF rules via the GET/POST parameters field.
  When blocked, Bind() returns a non-nil SqreenError value and its caller should immediately return.
  Read more about the blocking behavior at https://docs.sqreen.com/go/integration.

Fix

• (#153) RASP shellshock: properly handle environment variables containing variable definitions (eg. TERMCAP).

v0.15.0

New Feature

• (#149) Add activity monitoring of RASP protections. The number of times a protection has been used in the application is now displayed on the Activity tab of each RASP protection dashboard page.

Fixes

• (#148) Fix the usage of the Go agent in a reverse proxy server: avoid automatically reading a POST request's body because of the former usage of Request.ParseForm() in Sqreen's middleware functions, and rather get POST form values from Request.PostForm, and URL query values from Request.URL.Query().
  Note that since Request.PostForm's value is assigned by Request.ParseForm(), the In-WAF and RASP protections will now consider POST form values when the request handler will have called Request.ParseForm() itself for its own needs.
  Therefore, the In-App WAF is now also attached to ParseForm() to monitor the resulting POST form values, which can return a non-nil error when an attack is detected (cf. https://docs.sqreen.com/go/integration for more Go integration details).

• (ef81fc2) Enforce a request body reader to ignore it when blocked by the In-App WAF by returning it 0 bytes read along with the current non-nil error. This allows for example io.LimitReader not to copy the body buffer despite the non-nil error returned by the In-App WAF protection.

v0.14.0

New Feature

• (#142) RASP: add Shellshock protection support. This protection is currently attached to os.StartProcess() which is the common function of the Go standard library to execute a process. This protection can be configured at https://my.sqreen.com/application/goto/modules/rasp/details/shellshock.

Fixes

• (#145) In-App WAF: always recover from panics as this in the way the reflect package handles usage errors.

• (#144) Backend client: avoid dropping HTTP traces in case of Host header parsing errors.

v0.13.0

New Feature

• (#137) RASP: add noSQL Injection protection support for the Go MongoDB driver go.mongodb.org/mongo-driver/mongo. This protection can be configured at https://my.sqreen.com/application/goto/modules/rasp/details/nosql_injection.

Internal Changes

• (#138) Health-check the HTTPS connectivity to the new backend API ingestion.sqreen.com before using it. Fallback to the usual back.sqreen.com in case of a connection issue. Therefore, the agent can take up to 30 seconds to connect to Sqreen if the health-check timeouts. Please make sure to add this new domain to your firewall or proxy configurations.

• (#136) Add support to attach multiple security protections per hook point.

Fixes

• (#140) Fix the In-App WAF metadata PII scrubbing to also match substrings.