Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

newrelic/newrelic-ruby-agent

              dev @ 1faadae
            

Fixes

CVEs

HIGH

Peak severity

50.0%

Coverage

Highlights

Information Disclosure: 12 prior fixes. Scrutinize any change in this area.

lib/new_relic/agent/configuration/high_security_source.rb: most-fixed (4 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Information Disclosure: High Security Mode (HSM) is intended as a strict barrier to prevent transmitting sensitive data. Multiple historical failures showed that under HSM, sensitive parameters, custom insights events, redis commands, and attributes could still leak if individual features did not explicitly verify and inherit the restrictive HSM configuration source.

Cross-Site Scripting (XSS): The agent extracts transaction tokens from client-side cookies (such as 'NRAGENT') and reflects them into downstream web templates. Insufficient sanitization of these tokens with output encoding helpers (such as ERB::Util.h) historically allowed reflected XSS injection attacks.

Code Injection: The method tracer dynamically defines tracing methods using metaprogramming. A failure to rigorously sanitize input method names before passing them to class_eval created a direct vector for remote code execution.