Trend Micro Cloud One Application Security for Node
What is it?
Trend Micro Cloud One - Application Security provides real-time application security as a service for modern applications, APIs, serverless and other computing platforms. When Application Security is deployed, threats to your web applications will be detected and protected against, minimizing your risk.
Features
Application Security detects and protects against a wide range of attacks at runtime within your entire application, including: SQL injections Remote command execution Illegal file access Malicious file uploads Malicious payloads URL redirects And more
Support
The agent currently supports the following:
- Ubuntu, Debian, RedHat, CentOS or Alpine on x86 64 bits architecture
- Node 10, 12, 14
- ECMA 5 & 6
Some features require specific components to work:
| Feature | Required Component |
|---|---|
| SQLi | body-parser ^1.19 or busboy ^0.2.14 and one of the following:
|
| Open Redirect |
|
| Malicious Payload | body-parser1 ^1.19 or busboy ^ 0.2.14 |
Installation
From the root of your Node app:
$ npm install --save trend_app_protect
Usage
To activate Application Security, add the following as the first line of your app setup code:
require('trend_app_protect');
//import support added in version 4.5.0 and above for projects that require/support es6 modules
import 'trend_app_protect';The choice of statements to use between require or import are dependant on the the application itself, the modules used and declarations in the package files. It's independant of Application Security.
Generally, require must be used. When the server setup is done within an ES module, import can be used. If the {type: module} flag is set in the package.json, import must be used.
Please refer to the official NodeJS documentation for more details. Some references and examples on when to use require versus import:
- https://nodejs.org/dist/latest-v14.x/docs/api/all.html#esm_interoperability_with_commonjs
- https://nodejs.org/en/knowledge/getting-started/what-is-require/
- https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/import
Configuration
The agent key and secret can be configured via the TREND_AP_KEY and TREND_AP_SECRET environment variables.
If you are using a configuration file instead of using environment variables, it needs to be called trend_app_protect.json, be in the application root folder, and needs to contain at least the following:
{
"key": "my-key",
"secret": "my-secret"
}Notes
- Environment variables will take precedence over the configuration file
- Mutli-threaded agents is not supported. Any attempt to require or import the agent in a worker will fail and break the main event loop agent.