@contrast/contrast 1.0.0 → 1.0.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (213) hide show
  1. package/.prettierignore +3 -0
  2. package/README.md +115 -78
  3. package/dist/audit/AnalysisEngine.js +37 -0
  4. package/dist/audit/catalogueApplication/catalogueApplication.js +36 -0
  5. package/dist/audit/dotnetAnalysisEngine/index.js +25 -0
  6. package/dist/audit/dotnetAnalysisEngine/parseLockFileContents.js +35 -0
  7. package/dist/audit/dotnetAnalysisEngine/parseProjectFileContents.js +15 -0
  8. package/dist/audit/dotnetAnalysisEngine/readLockFileContents.js +18 -0
  9. package/dist/audit/dotnetAnalysisEngine/readProjectFileContents.js +14 -0
  10. package/dist/audit/dotnetAnalysisEngine/sanitizer.js +9 -0
  11. package/dist/audit/goAnalysisEngine/index.js +17 -0
  12. package/dist/audit/goAnalysisEngine/parseProjectFileContents.js +164 -0
  13. package/dist/audit/goAnalysisEngine/readProjectFileContents.js +21 -0
  14. package/dist/audit/goAnalysisEngine/sanitizer.js +5 -0
  15. package/dist/audit/javaAnalysisEngine/index.js +34 -0
  16. package/dist/audit/javaAnalysisEngine/parseMavenProjectFileContents.js +153 -0
  17. package/dist/audit/javaAnalysisEngine/parseProjectFileContents.js +353 -0
  18. package/dist/audit/javaAnalysisEngine/readProjectFileContents.js +98 -0
  19. package/dist/audit/javaAnalysisEngine/sanitizer.js +5 -0
  20. package/dist/audit/languageAnalysisEngine/checkForMultipleIdentifiedLanguages.js +24 -0
  21. package/dist/audit/languageAnalysisEngine/checkForMultipleIdentifiedProjectFiles.js +24 -0
  22. package/dist/audit/languageAnalysisEngine/checkIdentifiedLanguageHasLockFile.js +35 -0
  23. package/dist/audit/languageAnalysisEngine/checkIdentifiedLanguageHasProjectFile.js +23 -0
  24. package/dist/audit/languageAnalysisEngine/commonApi.js +18 -0
  25. package/dist/audit/languageAnalysisEngine/constants.js +20 -0
  26. package/dist/audit/languageAnalysisEngine/filterProjectPath.js +20 -0
  27. package/dist/audit/languageAnalysisEngine/getIdentifiedLanguageInfo.js +25 -0
  28. package/dist/audit/languageAnalysisEngine/getProjectRootFilenames.js +39 -0
  29. package/dist/audit/languageAnalysisEngine/index.js +39 -0
  30. package/dist/audit/languageAnalysisEngine/langugageAnalysisFactory.js +95 -0
  31. package/dist/audit/languageAnalysisEngine/reduceIdentifiedLanguages.js +121 -0
  32. package/dist/audit/languageAnalysisEngine/report/checkIgnoreDevDep.js +17 -0
  33. package/dist/audit/languageAnalysisEngine/report/commonReportingFunctions.js +257 -0
  34. package/dist/audit/languageAnalysisEngine/report/newReportingFeature.js +81 -0
  35. package/dist/audit/languageAnalysisEngine/report/reportingFeature.js +133 -0
  36. package/dist/audit/languageAnalysisEngine/sendSnapshot.js +41 -0
  37. package/dist/audit/languageAnalysisEngine/util/capabilities.js +11 -0
  38. package/dist/audit/languageAnalysisEngine/util/generalAPI.js +39 -0
  39. package/dist/audit/languageAnalysisEngine/util/requestUtils.js +14 -0
  40. package/dist/audit/nodeAnalysisEngine/handleNPMLockFileV2.js +40 -0
  41. package/dist/audit/nodeAnalysisEngine/index.js +31 -0
  42. package/dist/audit/nodeAnalysisEngine/parseNPMLockFileContents.js +18 -0
  43. package/dist/audit/nodeAnalysisEngine/parseYarn2LockFileContents.js +51 -0
  44. package/dist/audit/nodeAnalysisEngine/parseYarnLockFileContents.js +18 -0
  45. package/dist/audit/nodeAnalysisEngine/readNPMLockFileContents.js +17 -0
  46. package/dist/audit/nodeAnalysisEngine/readProjectFileContents.js +14 -0
  47. package/dist/audit/nodeAnalysisEngine/readYarnLockFileContents.js +24 -0
  48. package/dist/audit/nodeAnalysisEngine/sanitizer.js +9 -0
  49. package/dist/audit/phpAnalysisEngine/index.js +23 -0
  50. package/dist/audit/phpAnalysisEngine/parseLockFileContents.js +52 -0
  51. package/dist/audit/phpAnalysisEngine/readLockFileContents.js +13 -0
  52. package/dist/audit/phpAnalysisEngine/readProjectFileContents.js +16 -0
  53. package/dist/audit/phpAnalysisEngine/sanitizer.js +5 -0
  54. package/dist/audit/pythonAnalysisEngine/index.js +25 -0
  55. package/dist/audit/pythonAnalysisEngine/parsePipfileLockContents.js +17 -0
  56. package/dist/audit/pythonAnalysisEngine/parseProjectFileContents.js +21 -0
  57. package/dist/audit/pythonAnalysisEngine/readPipfileLockFileContents.js +13 -0
  58. package/dist/audit/pythonAnalysisEngine/readPythonProjectFileContents.js +14 -0
  59. package/dist/audit/pythonAnalysisEngine/sanitizer.js +7 -0
  60. package/dist/audit/rubyAnalysisEngine/index.js +25 -0
  61. package/dist/audit/rubyAnalysisEngine/parseGemfileLockContents.js +176 -0
  62. package/dist/audit/rubyAnalysisEngine/parsedGemfile.js +22 -0
  63. package/dist/audit/rubyAnalysisEngine/readGemfileContents.js +14 -0
  64. package/dist/audit/rubyAnalysisEngine/readGemfileLockContents.js +14 -0
  65. package/dist/audit/rubyAnalysisEngine/sanitizer.js +6 -0
  66. package/dist/commands/audit/auditConfig.js +25 -0
  67. package/dist/commands/audit/auditController.js +31 -0
  68. package/dist/commands/audit/help.js +52 -0
  69. package/dist/commands/audit/processAudit.js +18 -0
  70. package/dist/commands/audit/saveFile.js +11 -0
  71. package/dist/commands/auth/auth.js +20 -2
  72. package/dist/commands/config/config.js +19 -8
  73. package/dist/commands/scan/processScan.js +9 -13
  74. package/dist/common/HTTPClient.js +112 -13
  75. package/dist/common/errorHandling.js +65 -1
  76. package/dist/common/versionChecker.js +30 -0
  77. package/dist/constants/constants.js +4 -2
  78. package/dist/constants/lambda.js +32 -4
  79. package/dist/constants/locales.js +60 -21
  80. package/dist/constants.js +181 -21
  81. package/dist/index.js +50 -23
  82. package/dist/lambda/aws.js +14 -11
  83. package/dist/lambda/help.js +4 -0
  84. package/dist/lambda/lambda.js +50 -27
  85. package/dist/lambda/lambdaUtils.js +72 -0
  86. package/dist/lambda/logUtils.js +11 -1
  87. package/dist/lambda/scanDetailCompletion.js +4 -4
  88. package/dist/lambda/scanRequest.js +11 -5
  89. package/dist/lambda/utils.js +110 -53
  90. package/dist/sbom/generateSbom.js +20 -0
  91. package/dist/scan/autoDetection.js +0 -32
  92. package/dist/scan/fileUtils.js +1 -1
  93. package/dist/scan/help.js +14 -40
  94. package/dist/scan/populateProjectIdAndProjectName.js +5 -0
  95. package/dist/scan/saveResults.js +14 -0
  96. package/dist/scan/scan.js +105 -40
  97. package/dist/scan/scanConfig.js +39 -0
  98. package/dist/scan/scanController.js +19 -16
  99. package/dist/scan/scanResults.js +24 -16
  100. package/dist/utils/commonApi.js +3 -3
  101. package/dist/utils/paramsUtil/commandlineParams.js +1 -20
  102. package/dist/utils/paramsUtil/paramHandler.js +3 -6
  103. package/dist/utils/parsedCLIOptions.js +14 -8
  104. package/dist/utils/requestUtils.js +1 -1
  105. package/dist/utils/saveFile.js +19 -0
  106. package/package.json +26 -21
  107. package/src/audit/AnalysisEngine.js +103 -0
  108. package/src/audit/catalogueApplication/catalogueApplication.js +42 -0
  109. package/src/audit/dotnetAnalysisEngine/index.js +26 -0
  110. package/src/audit/dotnetAnalysisEngine/parseLockFileContents.js +47 -0
  111. package/src/audit/dotnetAnalysisEngine/parseProjectFileContents.js +29 -0
  112. package/src/audit/dotnetAnalysisEngine/readLockFileContents.js +30 -0
  113. package/src/audit/dotnetAnalysisEngine/readProjectFileContents.js +26 -0
  114. package/src/audit/dotnetAnalysisEngine/sanitizer.js +11 -0
  115. package/src/audit/goAnalysisEngine/index.js +18 -0
  116. package/src/audit/goAnalysisEngine/parseProjectFileContents.js +209 -0
  117. package/src/audit/goAnalysisEngine/readProjectFileContents.js +31 -0
  118. package/src/audit/goAnalysisEngine/sanitizer.js +7 -0
  119. package/src/audit/javaAnalysisEngine/index.js +41 -0
  120. package/src/audit/javaAnalysisEngine/parseMavenProjectFileContents.js +222 -0
  121. package/src/audit/javaAnalysisEngine/parseProjectFileContents.js +420 -0
  122. package/src/audit/javaAnalysisEngine/readProjectFileContents.js +141 -0
  123. package/src/audit/javaAnalysisEngine/sanitizer.js +6 -0
  124. package/src/audit/languageAnalysisEngine/checkForMultipleIdentifiedLanguages.js +35 -0
  125. package/src/audit/languageAnalysisEngine/checkForMultipleIdentifiedProjectFiles.js +41 -0
  126. package/src/audit/languageAnalysisEngine/checkIdentifiedLanguageHasLockFile.js +54 -0
  127. package/src/audit/languageAnalysisEngine/checkIdentifiedLanguageHasProjectFile.js +32 -0
  128. package/src/audit/languageAnalysisEngine/commonApi.js +20 -0
  129. package/src/audit/languageAnalysisEngine/constants.js +23 -0
  130. package/src/audit/languageAnalysisEngine/filterProjectPath.js +21 -0
  131. package/src/audit/languageAnalysisEngine/getIdentifiedLanguageInfo.js +41 -0
  132. package/src/audit/languageAnalysisEngine/getProjectRootFilenames.js +72 -0
  133. package/src/audit/languageAnalysisEngine/index.js +45 -0
  134. package/src/audit/languageAnalysisEngine/langugageAnalysisFactory.js +126 -0
  135. package/src/audit/languageAnalysisEngine/reduceIdentifiedLanguages.js +177 -0
  136. package/src/audit/languageAnalysisEngine/report/checkIgnoreDevDep.js +27 -0
  137. package/src/audit/languageAnalysisEngine/report/commonReportingFunctions.js +303 -0
  138. package/src/audit/languageAnalysisEngine/report/newReportingFeature.js +124 -0
  139. package/src/audit/languageAnalysisEngine/report/reportingFeature.js +190 -0
  140. package/src/audit/languageAnalysisEngine/sendSnapshot.js +51 -0
  141. package/src/audit/languageAnalysisEngine/util/capabilities.js +12 -0
  142. package/src/audit/languageAnalysisEngine/util/generalAPI.js +43 -0
  143. package/src/audit/languageAnalysisEngine/util/requestUtils.js +17 -0
  144. package/src/audit/nodeAnalysisEngine/handleNPMLockFileV2.js +49 -0
  145. package/src/audit/nodeAnalysisEngine/index.js +35 -0
  146. package/src/audit/nodeAnalysisEngine/parseNPMLockFileContents.js +20 -0
  147. package/src/audit/nodeAnalysisEngine/parseYarn2LockFileContents.js +63 -0
  148. package/src/audit/nodeAnalysisEngine/parseYarnLockFileContents.js +26 -0
  149. package/src/audit/nodeAnalysisEngine/readNPMLockFileContents.js +23 -0
  150. package/src/audit/nodeAnalysisEngine/readProjectFileContents.js +27 -0
  151. package/src/audit/nodeAnalysisEngine/readYarnLockFileContents.js +36 -0
  152. package/src/audit/nodeAnalysisEngine/sanitizer.js +11 -0
  153. package/src/audit/phpAnalysisEngine/index.js +27 -0
  154. package/src/audit/phpAnalysisEngine/parseLockFileContents.js +60 -0
  155. package/src/audit/phpAnalysisEngine/readLockFileContents.js +14 -0
  156. package/src/audit/phpAnalysisEngine/readProjectFileContents.js +25 -0
  157. package/src/audit/phpAnalysisEngine/sanitizer.js +4 -0
  158. package/src/audit/pythonAnalysisEngine/index.js +55 -0
  159. package/src/audit/pythonAnalysisEngine/parsePipfileLockContents.js +23 -0
  160. package/src/audit/pythonAnalysisEngine/parseProjectFileContents.js +33 -0
  161. package/src/audit/pythonAnalysisEngine/readPipfileLockFileContents.js +16 -0
  162. package/src/audit/pythonAnalysisEngine/readPythonProjectFileContents.js +22 -0
  163. package/src/audit/pythonAnalysisEngine/sanitizer.js +9 -0
  164. package/src/audit/rubyAnalysisEngine/index.js +30 -0
  165. package/src/audit/rubyAnalysisEngine/parseGemfileLockContents.js +215 -0
  166. package/src/audit/rubyAnalysisEngine/parsedGemfile.js +39 -0
  167. package/src/audit/rubyAnalysisEngine/readGemfileContents.js +18 -0
  168. package/src/audit/rubyAnalysisEngine/readGemfileLockContents.js +17 -0
  169. package/src/audit/rubyAnalysisEngine/sanitizer.js +8 -0
  170. package/src/commands/audit/auditConfig.ts +30 -0
  171. package/src/commands/audit/auditController.ts +31 -0
  172. package/src/commands/audit/help.ts +48 -0
  173. package/src/commands/audit/processAudit.ts +18 -0
  174. package/src/commands/audit/saveFile.ts +6 -0
  175. package/src/commands/auth/auth.js +26 -2
  176. package/src/commands/config/config.js +22 -8
  177. package/src/commands/scan/processScan.js +9 -13
  178. package/src/common/HTTPClient.js +149 -14
  179. package/src/common/errorHandling.ts +85 -2
  180. package/src/common/versionChecker.ts +39 -0
  181. package/src/constants/constants.js +5 -4
  182. package/src/constants/lambda.js +45 -4
  183. package/src/constants/locales.js +76 -26
  184. package/src/constants.js +204 -23
  185. package/src/index.ts +67 -27
  186. package/src/lambda/aws.ts +13 -12
  187. package/src/lambda/help.ts +4 -0
  188. package/src/lambda/lambda.ts +53 -34
  189. package/src/lambda/lambdaUtils.ts +111 -0
  190. package/src/lambda/logUtils.ts +19 -1
  191. package/src/lambda/scanDetailCompletion.ts +4 -4
  192. package/src/lambda/scanRequest.ts +13 -11
  193. package/src/lambda/utils.ts +149 -81
  194. package/src/sbom/generateSbom.ts +17 -0
  195. package/src/scan/autoDetection.js +0 -29
  196. package/src/scan/fileUtils.js +1 -1
  197. package/src/scan/help.js +14 -45
  198. package/src/scan/populateProjectIdAndProjectName.js +5 -0
  199. package/src/scan/saveResults.js +14 -0
  200. package/src/scan/scan.js +127 -58
  201. package/src/scan/scanConfig.js +54 -0
  202. package/src/scan/scanController.js +22 -15
  203. package/src/scan/scanResults.js +32 -19
  204. package/src/utils/commonApi.js +2 -3
  205. package/src/utils/getConfig.ts +2 -0
  206. package/src/utils/paramsUtil/commandlineParams.js +1 -26
  207. package/src/utils/paramsUtil/paramHandler.js +3 -7
  208. package/src/utils/parsedCLIOptions.js +11 -9
  209. package/src/utils/requestUtils.js +1 -1
  210. package/src/utils/saveFile.js +19 -0
  211. package/dist/lambda/scanDetail.js +0 -30
  212. package/dist/scan/fileFinder.js +0 -15
  213. package/dist/utils/paramsUtil/yamlParams.js +0 -6
@@ -0,0 +1,51 @@
1
+ "use strict";
2
+ const i18n = require('i18n');
3
+ module.exports = exports = ({ language: { lockFilename }, node }, next) => {
4
+ if (node.rawYarnLockFileContents == undefined || node.yarnVersion == 1) {
5
+ next();
6
+ }
7
+ else {
8
+ try {
9
+ node.yarnLockFile = {};
10
+ node.yarnLockFile['object'] = node.rawYarnLockFileContents;
11
+ delete node.yarnLockFile['object'].__metadata;
12
+ node.yarnLockFile['type'] = 'success';
13
+ Object.entries(node.rawYarnLockFileContents).forEach(([key, value]) => {
14
+ const rawKeyNames = key.split(',');
15
+ const keyNames = formatKey(rawKeyNames);
16
+ keyNames.forEach(name => {
17
+ node.yarnLockFile.object[name] = value;
18
+ });
19
+ });
20
+ }
21
+ catch (err) {
22
+ next(new Error(i18n.__('NodeParseYarn2', lockFilename.lockFilePath) +
23
+ `${err.message}`));
24
+ return;
25
+ }
26
+ next();
27
+ }
28
+ };
29
+ function formatKey(keyNames) {
30
+ let name = '';
31
+ let formattedNames = [];
32
+ keyNames.forEach(dummyString => {
33
+ let nameArr = dummyString.split('@');
34
+ if (nameArr.length > 1) {
35
+ if (nameArr.length == 2) {
36
+ name = nameArr[0];
37
+ }
38
+ if (nameArr.length == 3) {
39
+ name = '@' + nameArr[1];
40
+ }
41
+ let version = dummyString.split(':').pop('');
42
+ if (version.length == 1 && version != '*') {
43
+ version = version + '.0';
44
+ }
45
+ let reformattedKey = name.trim() + '@' + version;
46
+ formattedNames.push(reformattedKey);
47
+ }
48
+ });
49
+ return formattedNames;
50
+ }
51
+ exports.formatKey = formatKey;
@@ -0,0 +1,18 @@
1
+ "use strict";
2
+ const yarnParser = require('@yarnpkg/lockfile');
3
+ const i18n = require('i18n');
4
+ module.exports = exports = ({ language: { lockFilename }, node }, next) => {
5
+ if (node.rawYarnLockFileContents === undefined || node.yarnVersion === 2) {
6
+ next();
7
+ }
8
+ else {
9
+ try {
10
+ node.yarnLockFile = yarnParser.parse(node.rawYarnLockFileContents);
11
+ }
12
+ catch (err) {
13
+ next(new Error(i18n.__('NodeParseYarn', lockFilename.lockFilePath ? lockFilename.lockFilePath : 'undefined') + `${err.message}`));
14
+ return;
15
+ }
16
+ next();
17
+ }
18
+ };
@@ -0,0 +1,17 @@
1
+ "use strict";
2
+ const fs = require('fs');
3
+ const i18n = require('i18n');
4
+ module.exports = exports = ({ language: { lockFilePath }, node }, next) => {
5
+ if (!lockFilePath || !lockFilePath.includes('package-lock.json')) {
6
+ next();
7
+ return;
8
+ }
9
+ try {
10
+ node.rawLockFileContents = fs.readFileSync(lockFilePath);
11
+ }
12
+ catch (err) {
13
+ next(new Error(i18n.__('NodeReadNpmError', lockFilePath) + `${err.message}`));
14
+ return;
15
+ }
16
+ next();
17
+ };
@@ -0,0 +1,14 @@
1
+ "use strict";
2
+ const fs = require('fs');
3
+ const i18n = require('i18n');
4
+ module.exports = exports = (analysis, next) => {
5
+ const { language: { projectFilePath }, node } = analysis;
6
+ try {
7
+ node.packageJSON = JSON.parse(fs.readFileSync(projectFilePath, 'utf8'));
8
+ }
9
+ catch (err) {
10
+ next(new Error(i18n.__('nodeReadProjectFileError', projectFilePath) + `${err.message}`));
11
+ return;
12
+ }
13
+ next();
14
+ };
@@ -0,0 +1,24 @@
1
+ "use strict";
2
+ const fs = require('fs');
3
+ const yaml = require('js-yaml');
4
+ const i18n = require('i18n');
5
+ module.exports = exports = ({ language: { lockFilePath }, node }, next) => {
6
+ if (!lockFilePath || !lockFilePath.includes('yarn.lock')) {
7
+ next();
8
+ return;
9
+ }
10
+ try {
11
+ node.rawYarnLockFileContents = fs.readFileSync(lockFilePath, 'utf8');
12
+ node.yarnVersion = 1;
13
+ if (!node.rawYarnLockFileContents.includes('lockfile v1') ||
14
+ node.rawYarnLockFileContents.includes('__metadata')) {
15
+ node.rawYarnLockFileContents = yaml.load(fs.readFileSync(lockFilePath, 'utf8'));
16
+ node.yarnVersion = 2;
17
+ }
18
+ }
19
+ catch (err) {
20
+ next(new Error(i18n.__('nodeReadYarnLockFileError', lockFilePath) + `${err.message}`));
21
+ return;
22
+ }
23
+ next();
24
+ };
@@ -0,0 +1,9 @@
1
+ "use strict";
2
+ module.exports = exports = ({ node }, next) => {
3
+ delete node.rawProjectFileContents;
4
+ delete node.projectFileJSON;
5
+ delete node.projectLockFileJSON;
6
+ delete node.rawLockFileContents;
7
+ delete node.rawYarnLockFileContents;
8
+ next();
9
+ };
@@ -0,0 +1,23 @@
1
+ "use strict";
2
+ const AnalysisEngine = require('../AnalysisEngine');
3
+ const readProjectFileContents = require('./readProjectFileContents');
4
+ const readLockFileContents = require('./readLockFileContents');
5
+ const parseLockFileContents = require('./parseLockFileContents');
6
+ const sanitizer = require('./sanitizer');
7
+ const i18n = require('i18n');
8
+ module.exports = exports = (language, config, callback) => {
9
+ const ae = new AnalysisEngine({ language, config, php: {} });
10
+ ae.use([
11
+ readProjectFileContents,
12
+ readLockFileContents,
13
+ parseLockFileContents,
14
+ sanitizer
15
+ ]);
16
+ ae.analyze((err, analysis) => {
17
+ if (err) {
18
+ callback(new Error(i18n.__('phpAnalysisFailure') + `${err.message}`));
19
+ return;
20
+ }
21
+ callback(null, analysis);
22
+ });
23
+ };
@@ -0,0 +1,52 @@
1
+ "use strict";
2
+ const i18n = require('i18n');
3
+ const _ = require('lodash');
4
+ module.exports = exports = ({ language: { lockFilePath }, php }, next) => {
5
+ try {
6
+ php.lockFile = php.rawLockFileContents;
7
+ let packages = _.keyBy(php.lockFile.packages, 'name');
8
+ let packagesDev = _.keyBy(php.lockFile['packages-dev'], 'name');
9
+ php.lockFile.dependencies = _.merge(packages, packagesDev);
10
+ const listOfTopDep = Object.keys(php.lockFile.dependencies);
11
+ Object.entries(php.lockFile.dependencies).forEach(([key, value]) => {
12
+ if (value.require) {
13
+ const listOfRequiresDep = Object.keys(value.require);
14
+ listOfRequiresDep.forEach(dep => {
15
+ if (!listOfTopDep.includes(dep)) {
16
+ addChildDepToLockFileAsOwnObj(value['require'], dep);
17
+ }
18
+ });
19
+ }
20
+ if (value['require-dev']) {
21
+ const listOfRequiresDep = Object.keys(value['require-dev']);
22
+ listOfRequiresDep.forEach(dep => {
23
+ if (!listOfTopDep.includes(dep)) {
24
+ addChildDepToLockFileAsOwnObj(value['require-dev'], dep);
25
+ }
26
+ });
27
+ }
28
+ });
29
+ formatParentDepToLockFile();
30
+ }
31
+ catch (err) {
32
+ next(new Error(i18n.__('phpParseComposerLock', lockFilePath) + `${err.message}`));
33
+ return;
34
+ }
35
+ next();
36
+ function addChildDepToLockFileAsOwnObj(depObj, key) {
37
+ php.lockFile.dependencies[key] = { version: depObj[key] };
38
+ }
39
+ function formatParentDepToLockFile() {
40
+ for (const [key, value] of Object.entries(php.lockFile.dependencies)) {
41
+ let requires = {};
42
+ for (const [childKey, childValue] of Object.entries(value)) {
43
+ if (childKey === 'require' || childKey === 'require-dev') {
44
+ requires = _.merge(requires, childValue);
45
+ php.lockFile.dependencies[key].requires = requires;
46
+ delete php.lockFile.dependencies[key].require;
47
+ delete php.lockFile.dependencies[key]['require-dev'];
48
+ }
49
+ }
50
+ }
51
+ }
52
+ };
@@ -0,0 +1,13 @@
1
+ "use strict";
2
+ const fs = require('fs');
3
+ const i18n = require('i18n');
4
+ module.exports = exports = ({ language: { lockFilePath }, php }, next) => {
5
+ try {
6
+ php.rawLockFileContents = JSON.parse(fs.readFileSync(lockFilePath));
7
+ }
8
+ catch (err) {
9
+ next(new Error(i18n.__('phpReadError', lockFilePath) + `${err.message}`));
10
+ return;
11
+ }
12
+ next();
13
+ };
@@ -0,0 +1,16 @@
1
+ "use strict";
2
+ const fs = require('fs');
3
+ const i18n = require('i18n');
4
+ module.exports = exports = (analysis, next) => {
5
+ const { language: { projectFilePath }, php } = analysis;
6
+ try {
7
+ php.composerJSON = JSON.parse(fs.readFileSync(projectFilePath, 'utf8'));
8
+ php.composerJSON.dependencies = php.composerJSON.require;
9
+ php.composerJSON.devDependencies = php.composerJSON['require-dev'];
10
+ }
11
+ catch (err) {
12
+ next(new Error(i18n.__('phpReadProjectFileError', projectFilePath) + `${err.message}`));
13
+ return;
14
+ }
15
+ next();
16
+ };
@@ -0,0 +1,5 @@
1
+ "use strict";
2
+ module.exports = exports = ({ php }, next) => {
3
+ delete php.rawLockFileContents;
4
+ next();
5
+ };
@@ -0,0 +1,25 @@
1
+ "use strict";
2
+ const AnalysisEngine = require('./../AnalysisEngine');
3
+ const readPythonProjectFileContents = require('./readPythonProjectFileContents');
4
+ const readPipfileLockFileContents = require('./readPipfileLockFileContents');
5
+ const parseProjectFileContents = require('./parseProjectFileContents');
6
+ const parsePipfileLockContents = require('./parsePipfileLockContents');
7
+ const sanitizer = require('./sanitizer');
8
+ const i18n = require('i18n');
9
+ module.exports = exports = (language, config, callback) => {
10
+ const ae = new AnalysisEngine({ language, config, python: {} });
11
+ ae.use([
12
+ readPythonProjectFileContents,
13
+ parseProjectFileContents,
14
+ readPipfileLockFileContents,
15
+ parsePipfileLockContents,
16
+ sanitizer
17
+ ]);
18
+ ae.analyze((err, analysis) => {
19
+ if (err) {
20
+ callback(new Error(i18n.__('pythonAnalysisEngineError') + `${err.message}`));
21
+ return;
22
+ }
23
+ callback(null, analysis);
24
+ });
25
+ };
@@ -0,0 +1,17 @@
1
+ "use strict";
2
+ const i18n = require('i18n');
3
+ module.exports = exports = ({ language: { lockFilePath }, python }, next) => {
4
+ if (python.rawLockFileContents === undefined) {
5
+ return next();
6
+ }
7
+ try {
8
+ let parsedPipLock = JSON.parse(python.rawLockFileContents);
9
+ parsedPipLock['defaults'] = parsedPipLock['default'];
10
+ python.pipfileLock = parsedPipLock;
11
+ }
12
+ catch (err) {
13
+ next(new Error(i18n.__('pythonAnalysisEnginePipError', lockFilePath ? lockFilePath : 'undefined') + `${err.message}`));
14
+ return;
15
+ }
16
+ next();
17
+ };
@@ -0,0 +1,21 @@
1
+ "use strict";
2
+ const multiReplace = require('string-multiple-replace');
3
+ const i18n = require('i18n');
4
+ module.exports = exports = ({ python }, next) => {
5
+ const { rawProjectFileContents } = python;
6
+ try {
7
+ const matcherObj = { '"': '' };
8
+ const sequencer = ['"'];
9
+ const parsedPipfile = multiReplace(rawProjectFileContents, matcherObj, sequencer);
10
+ const pythonArray = parsedPipfile.split('\n');
11
+ python.pipfilDependanceies = pythonArray.filter(element => {
12
+ return element != '' && !element.includes('#');
13
+ });
14
+ next();
15
+ }
16
+ catch (err) {
17
+ next(new Error(i18n.__('pythonAnalysisParseProjectFileError', rawProjectFileContents) +
18
+ `${err.message}`));
19
+ return;
20
+ }
21
+ };
@@ -0,0 +1,13 @@
1
+ "use strict";
2
+ const fs = require('fs');
3
+ const i18n = require('i18n');
4
+ module.exports = exports = ({ language: { lockFilePath }, python }, next) => {
5
+ try {
6
+ python.rawLockFileContents = fs.readFileSync(lockFilePath);
7
+ }
8
+ catch (err) {
9
+ next(new Error(i18n.__('pythonAnalysisReadPipFileError', lockFilePath) +
10
+ `${err.message}`));
11
+ }
12
+ next();
13
+ };
@@ -0,0 +1,14 @@
1
+ "use strict";
2
+ const fs = require('fs');
3
+ const i18n = require('i18n');
4
+ module.exports = exports = ({ language: { projectFilePath }, python }, next) => {
5
+ try {
6
+ python.rawProjectFileContents = fs.readFileSync(projectFilePath, 'utf8');
7
+ next();
8
+ }
9
+ catch (err) {
10
+ next(new Error(i18n.__('pythonAnalysisReadPythonProjectFileError', projectFilePath) +
11
+ `${err.message}`));
12
+ return;
13
+ }
14
+ };
@@ -0,0 +1,7 @@
1
+ "use strict";
2
+ module.exports = exports = ({ python }, next) => {
3
+ delete python.rawProjectFileContents;
4
+ delete python.rawLockFileContents;
5
+ delete python.pipfileLock.default;
6
+ next();
7
+ };
@@ -0,0 +1,25 @@
1
+ "use strict";
2
+ const AnalysisEngine = require('./../AnalysisEngine');
3
+ const readGemfileContents = require('./readGemfileContents');
4
+ const readGemfileLockContents = require('./readGemfileLockContents');
5
+ const parsedGemfile = require('./parsedGemfile');
6
+ const parseGemfileLockFileContents = require('./parseGemfileLockContents');
7
+ const sanitizer = require('./sanitizer');
8
+ const i18n = require('i18n');
9
+ module.exports = exports = (language, config, callback) => {
10
+ const ae = new AnalysisEngine({ language, config, ruby: {} });
11
+ ae.use([
12
+ readGemfileContents,
13
+ parsedGemfile,
14
+ readGemfileLockContents,
15
+ parseGemfileLockFileContents,
16
+ sanitizer
17
+ ]);
18
+ ae.analyze((err, analysis) => {
19
+ if (err) {
20
+ callback(new Error(i18n.__('rubyAnalysisEngineError') + `${err.message}`));
21
+ return;
22
+ }
23
+ callback(null, analysis);
24
+ });
25
+ };
@@ -0,0 +1,176 @@
1
+ "use strict";
2
+ const whitespaceRegx = /^(\s*)/;
3
+ let index = 0;
4
+ const depReg = /^\s*([A-Za-z0-9.!@#$%\-^&*_+]*)\s*(\((.*?)\))/;
5
+ const i18n = require('i18n');
6
+ const GEMFILE_KEY_VALUE = /^\s*([^:(]*)\s*\:*\s*(.*)/;
7
+ let rubyObj = {};
8
+ rubyObj.dependencies = {};
9
+ module.exports = exports = ({ ruby }, next) => {
10
+ const { rawLockFileContents } = ruby;
11
+ let lines = rawLockFileContents.split('\n');
12
+ try {
13
+ ruby.gemfileLock = {};
14
+ getDirectDepencies(lines, ruby.gemfileLock);
15
+ getRubyVersion(lines, ruby.gemfileLock);
16
+ getSourceArr(lines, ruby.gemfileLock);
17
+ next();
18
+ }
19
+ catch (err) {
20
+ next(new Error(i18n.__('rubyAnalysisEngineParsedGemLockFileError') + `${err.message}`));
21
+ }
22
+ };
23
+ const populateSourceType = (line, rubyObj) => {
24
+ return (rubyObj.sourceType = line);
25
+ };
26
+ const nonDependencyKeys = (line, rubyObj) => {
27
+ let parts = GEMFILE_KEY_VALUE.exec(line);
28
+ let key = parts[1].trim();
29
+ let value = parts[2] || '';
30
+ return (rubyObj[key] = value);
31
+ };
32
+ const populateResolveAndPlatform = (dependency, rubyObj) => {
33
+ const depArr = dependency.split('-');
34
+ rubyObj.resolved = depArr[0];
35
+ rubyObj.platform = depArr.length > 1 ? depArr[1] : 'UNSPECIFIED';
36
+ return rubyObj;
37
+ };
38
+ const isUpperCase = str => {
39
+ return str === str.toUpperCase();
40
+ };
41
+ const getDirectDepencies = (lines, ruby) => {
42
+ let depIndex = 0;
43
+ for (let i = 0; i < lines.length; i++) {
44
+ if (lines[i] == 'DEPENDENCIES') {
45
+ depIndex = i;
46
+ }
47
+ }
48
+ const getDepArray = lines.slice(depIndex);
49
+ ruby.dependencies = {};
50
+ for (let j = 1; j < getDepArray.length; j++) {
51
+ const element = getDepArray[j];
52
+ if (!isUpperCase(element)) {
53
+ const isDependencyWithVersion = depReg.test(element);
54
+ if (isDependencyWithVersion) {
55
+ const dependency = depReg.exec(element);
56
+ let name = dependency[1];
57
+ name = name.replace('!', '');
58
+ ruby.dependencies[name.trim()] = dependency[3];
59
+ }
60
+ else {
61
+ let name = element;
62
+ name = name.replace('!', ' ');
63
+ ruby.dependencies[name.trim()] = 'UNSPECIFIED';
64
+ }
65
+ }
66
+ else {
67
+ return;
68
+ }
69
+ }
70
+ };
71
+ const getRubyVersion = (lines, ruby) => {
72
+ let rubVersionIndex = 0;
73
+ for (let i = 0; i < lines.length; i++) {
74
+ if (lines[i] == 'RUBY VERSION') {
75
+ rubVersionIndex = i;
76
+ break;
77
+ }
78
+ }
79
+ if (rubVersionIndex !== 0) {
80
+ const getRubyVersionArray = lines.slice(rubVersionIndex);
81
+ ruby.runtimeDetails = {};
82
+ for (let j = 1; j < getRubyVersionArray.length; j++) {
83
+ let element = getRubyVersionArray[j];
84
+ if (!isUpperCase(element)) {
85
+ element = element.trim();
86
+ if (/^([ruby\s0-9.*]+)/.test(element)) {
87
+ let splitElement = element.split(' ');
88
+ ruby.runtimeDetails['version'] = splitElement[1];
89
+ }
90
+ if (/^([p0-9]+)/.test(element)) {
91
+ ruby.runtimeDetails['patchLevel'] = element.substring(1);
92
+ }
93
+ if (element.includes('engine')) {
94
+ let splitElement = element.split(' ');
95
+ ruby.runtimeDetails[splitElement[0]] = splitElement[1];
96
+ }
97
+ }
98
+ else {
99
+ return;
100
+ }
101
+ }
102
+ }
103
+ };
104
+ const formatSourceArr = sourceArr => {
105
+ return sourceArr.map(element => {
106
+ if (element.sourceType === 'GIT') {
107
+ delete element.specs;
108
+ }
109
+ if (element.sourceType === 'GEM') {
110
+ delete element.branch;
111
+ delete element.revision;
112
+ delete element.depthLevel;
113
+ delete element.specs;
114
+ }
115
+ if (element.sourceType === 'PATH') {
116
+ delete element.branch;
117
+ delete element.revision;
118
+ delete element.depthLevel;
119
+ delete element.specs;
120
+ delete element.platform;
121
+ }
122
+ return element;
123
+ });
124
+ };
125
+ const getSourceArr = (lines, ruby) => {
126
+ let line = 0;
127
+ let source = [];
128
+ while ((line = lines[index++]) !== undefined) {
129
+ let currentWS = whitespaceRegx.exec(line)[1].length;
130
+ if (!line.includes(' bundler (')) {
131
+ if (currentWS === 0 && !line.includes(':') && line != '') {
132
+ populateSourceType(line, rubyObj);
133
+ }
134
+ if (currentWS !== 0 && line.includes(':')) {
135
+ nonDependencyKeys(line, rubyObj);
136
+ }
137
+ if (currentWS > 2) {
138
+ const isDependencyWithVersion = depReg.test(line);
139
+ let nexlineWS = whitespaceRegx.exec(lines[index])[1].length;
140
+ if (currentWS === 6) {
141
+ const dependency = depReg.exec(line);
142
+ if (isDependencyWithVersion) {
143
+ if (rubyObj.name !== dependency[1]) {
144
+ rubyObj.dependencies[dependency[1]] = dependency[3];
145
+ }
146
+ }
147
+ else {
148
+ rubyObj.dependencies[line.trim()] = 'UNSPECIFIED';
149
+ }
150
+ }
151
+ if (currentWS === 4 && rubyObj.depthLevel === undefined) {
152
+ const dependency = depReg.exec(line);
153
+ rubyObj.name = dependency[1];
154
+ rubyObj.depthLevel = currentWS;
155
+ populateResolveAndPlatform(dependency[3], rubyObj);
156
+ }
157
+ if (currentWS === 4 && rubyObj.depthLevel) {
158
+ const dependency = depReg.exec(line);
159
+ rubyObj.name = dependency[1];
160
+ rubyObj.depthLevel = currentWS;
161
+ populateResolveAndPlatform(dependency[3], rubyObj);
162
+ }
163
+ if ((currentWS === 4 && nexlineWS === 4) ||
164
+ (currentWS === 6 && nexlineWS === 4) ||
165
+ nexlineWS == '') {
166
+ let newObj = {};
167
+ newObj = JSON.parse(JSON.stringify(rubyObj));
168
+ source.push(newObj);
169
+ rubyObj.dependencies = {};
170
+ }
171
+ }
172
+ }
173
+ }
174
+ ruby.sources = formatSourceArr(source);
175
+ };
176
+ exports.getSourceArr = getSourceArr;
@@ -0,0 +1,22 @@
1
+ "use strict";
2
+ const i18n = require('i18n');
3
+ module.exports = exports = ({ ruby }, next) => {
4
+ const { rawProjectFileContents } = ruby;
5
+ try {
6
+ const rubyArray = rawProjectFileContents.split('\n');
7
+ let filteredRubyDep = rubyArray.filter(element => {
8
+ return (!element.includes('#') &&
9
+ element.includes('gem') &&
10
+ !element.includes('source'));
11
+ });
12
+ for (let i = 0; i < filteredRubyDep.length; i++) {
13
+ filteredRubyDep[i] = filteredRubyDep[i].trim();
14
+ }
15
+ ruby.gemfilesDependanceies = filteredRubyDep;
16
+ next();
17
+ }
18
+ catch (err) {
19
+ next(new Error(i18n.__('rubyAnalysisEngineParsedGemFileError', rawProjectFileContents) + `${err.message}`));
20
+ return;
21
+ }
22
+ };
@@ -0,0 +1,14 @@
1
+ "use strict";
2
+ const fs = require('fs');
3
+ const i18n = require('i18n');
4
+ module.exports = exports = ({ language: { projectFilePath }, ruby }, next) => {
5
+ try {
6
+ ruby.rawProjectFileContents = fs.readFileSync(projectFilePath, 'utf8');
7
+ next();
8
+ }
9
+ catch (err) {
10
+ next(new Error(i18n.__('rubyAnalysisEngineReadGemFileError', projectFilePath) +
11
+ `${err.message}`));
12
+ return;
13
+ }
14
+ };
@@ -0,0 +1,14 @@
1
+ "use strict";
2
+ const fs = require('fs');
3
+ const i18n = require('i18n');
4
+ module.exports = exports = ({ language: { lockFilePath }, ruby }, next) => {
5
+ try {
6
+ ruby.rawLockFileContents = fs.readFileSync(lockFilePath, 'utf8');
7
+ next();
8
+ }
9
+ catch (err) {
10
+ next(new Error(i18n.__('rubyAnalysisEngineReadGemLockFileError', lockFilePath) +
11
+ `${err.message}`));
12
+ return;
13
+ }
14
+ };
@@ -0,0 +1,6 @@
1
+ "use strict";
2
+ module.exports = exports = ({ ruby }, next) => {
3
+ delete ruby.rawProjectFileContents;
4
+ delete ruby.rawLockFileContents;
5
+ next();
6
+ };
@@ -0,0 +1,25 @@
1
+ "use strict";
2
+ var __importDefault = (this && this.__importDefault) || function (mod) {
3
+ return (mod && mod.__esModule) ? mod : { "default": mod };
4
+ };
5
+ Object.defineProperty(exports, "__esModule", { value: true });
6
+ exports.getAuditConfig = void 0;
7
+ const paramHandler_1 = __importDefault(require("../../utils/paramsUtil/paramHandler"));
8
+ const constants_1 = __importDefault(require("../../constants"));
9
+ const parsedCLIOptions_1 = __importDefault(require("../../utils/parsedCLIOptions"));
10
+ const constants_2 = __importDefault(require("../../audit/languageAnalysisEngine/constants"));
11
+ const { supportedLanguages: { NODE, JAVASCRIPT } } = constants_2.default;
12
+ const getAuditConfig = (argv) => {
13
+ const auditParameters = parsedCLIOptions_1.default.getCommandLineArgsCustom(argv, constants_1.default.commandLineDefinitions.auditOptionDefinitions);
14
+ const paramsAuth = paramHandler_1.default.getAuth(auditParameters);
15
+ if (auditParameters.language === undefined ||
16
+ auditParameters.language === null) {
17
+ console.log('error, --language parameter is required');
18
+ process.exit(1);
19
+ }
20
+ else if (auditParameters.language.toUpperCase() === JAVASCRIPT) {
21
+ auditParameters.language = NODE.toLowerCase();
22
+ }
23
+ return { ...paramsAuth, ...auditParameters };
24
+ };
25
+ exports.getAuditConfig = getAuditConfig;