@contrast/contrast 1.0.0

package/dist/lambda/scanResults.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getScanResults = void 0;
+const commonApi_1 = require("../utils/commonApi");
+const cliError_1 = require("./cliError");
+const constants_1 = require("./constants");
+const getScanResults = async (config, params, scanId, functionArn) => {
+    const client = (0, commonApi_1.getHttpClient)(config);
+    const { statusCode, body } = await client.getFunctionScanResults(config, params, scanId, functionArn);
+    if (statusCode === 200) {
+        return body;
+    }
+    const { errorCode } = body || {};
+    throw new cliError_1.CliError(constants_1.ERRORS.FAILED_TO_GET_RESULTS, { statusCode, errorCode });
+};
+exports.getScanResults = getScanResults;

package/dist/lambda/utils.js

@@ -0,0 +1,90 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.exportedForTesting = exports.prettyPrintResults = exports.toLowerKeys = void 0;
+const chalk_1 = __importDefault(require("chalk"));
+const lodash_1 = require("lodash");
+const logUtils_1 = require("./logUtils");
+const groupByCVE = ({ title }) => title.substring(0, title.indexOf('[') - 1);
+const groupByDependency = ({ title }) => title.substring(title.indexOf('[') + 1, title.indexOf(']'));
+const prettyPrintResults = (results) => {
+    (0, logUtils_1.log)('');
+    const vulnerabs = results.filter(r => r.category === 1 || r.category === 4);
+    const sortBySeverity = (0, lodash_1.sortBy)(vulnerabs, ['severity', 'title']);
+    const notDependencies = sortBySeverity.filter(r => r.category !== 1);
+    const dependencies = sortBySeverity.filter(r => r.category === 1);
+    const dependenciesByLibrary = (0, lodash_1.groupBy)(dependencies, groupByDependency);
+    const dependenciesCount = Object.keys(dependenciesByLibrary).length;
+    notDependencies.forEach(printVulnerability);
+    const prevIndex = notDependencies.length + 1;
+    Object.entries(dependenciesByLibrary).forEach(([library, group], i) => {
+        const maxSeverity = (0, lodash_1.minBy)(group, 'severity');
+        const allCves = group.map(groupByCVE);
+        (0, logUtils_1.log)(prevIndex + i);
+        (0, logUtils_1.log)(`${chalk_1.default.bold((0, lodash_1.capitalize)(maxSeverity.severityText))} | ${chalk_1.default.bold('Vulnerable dependency')} ${library} has ${group.length} known CVEs`);
+        (0, logUtils_1.log)(allCves.join(', '));
+        if (maxSeverity.remediation?.description) {
+            (0, logUtils_1.log)(`${chalk_1.default.bold('Recommendation:')} ${maxSeverity.remediation.description}`);
+        }
+        (0, logUtils_1.log)('');
+    });
+    const resultCount = notDependencies.length + dependenciesCount;
+    const groupByType = (0, lodash_1.groupBy)(notDependencies, ['categoryText']);
+    const summary = Object.values(groupByType).map(group => `${group.length} ${(0, lodash_1.capitalize)(group[0].categoryText)}`);
+    (0, logUtils_1.log)(`Found ${resultCount} vulnerabilities`, { bold: true });
+    summary.push(`${dependenciesCount} Dependencies`);
+    (0, logUtils_1.log)(chalk_1.default.bold(summary.join(' | ')));
+};
+exports.prettyPrintResults = prettyPrintResults;
+const underlineLinks = (text) => {
+    if (!text) {
+        return text;
+    }
+    const urlRegex = /(https?:\/\/[^\s]+)/g;
+    return text.replace(urlRegex, chalk_1.default.underline('$1'));
+};
+const printVulnerability = (vulnerability, index) => {
+    (0, logUtils_1.log)(index + 1);
+    const descriptionWithLinks = underlineLinks(vulnerability.description);
+    (0, logUtils_1.log)(`${chalk_1.default.bold((0, lodash_1.capitalize)(vulnerability.severityText))} | ${chalk_1.default.bold(vulnerability.title)} ${descriptionWithLinks}`);
+    const category = vulnerability?.categoryText;
+    switch (category) {
+        case 'PERMISSIONS':
+            printLeastPrivilegeRemediation(vulnerability);
+            break;
+        default:
+            printRemediation(vulnerability);
+    }
+    (0, logUtils_1.log)('');
+};
+const printLeastPrivilegeRemediation = (vulnerability) => {
+    (0, logUtils_1.log)(`${chalk_1.default.bold('Recommendation:')} Replace the existing policies with the following`);
+    const violatingPolicies = vulnerability?.evidence?.leastPrivilege?.violatingPolicies || [];
+    violatingPolicies
+        .filter((vp) => vp?.suggestedPolicy?.suggestedPolicyCode?.length)
+        .map((vp) => vp?.suggestedPolicy?.suggestedPolicyCode)
+        .forEach((policies) => {
+        policies.forEach((policy) => {
+            console.log(policy.snippet);
+        });
+    });
+};
+const printRemediation = (vulnerability) => {
+    (0, logUtils_1.log)(`Remediation - ${vulnerability?.remediation?.description || 'Unknown'}`);
+};
+function toLowerKeys(obj) {
+    return Object.keys(obj).reduce((accumulator, key) => {
+        const new_key = `${key[0].toLowerCase()}${key.slice(1)}`;
+        accumulator[new_key] = obj[key];
+        return accumulator;
+    }, {});
+}
+exports.toLowerKeys = toLowerKeys;
+exports.exportedForTesting = {
+    printLeastPrivilegeRemediation,
+    printRemediation,
+    printVulnerability,
+    underlineLinks
+};

package/dist/scan/autoDetection.js

@@ -0,0 +1,76 @@
+"use strict";
+const i18n = require('i18n');
+const { zipValidator } = require('./scan');
+const fileFinder = require('./fileUtils');
+const { supportedLanguages } = require('../constants/constants');
+const autoDetectFileAndLanguage = async (configToUse) => {
+    const entries = await fileFinder.findFile();
+    if (entries.length === 1) {
+        console.log(i18n.__('foundScanFile', entries[0]));
+        if (hasWhiteSpace(entries[0])) {
+            console.log(i18n.__('fileHasWhiteSpacesError'));
+            process.exit(1);
+        }
+        configToUse.file = entries[0];
+        if (configToUse.name === undefined) {
+            configToUse.name = entries[0];
+        }
+        zipValidator(configToUse);
+        assignLanguage(entries, configToUse);
+    }
+    else {
+        errorOnFileDetection(entries);
+    }
+};
+const hasWhiteSpace = s => {
+    const filename = s.split('/').pop();
+    return filename.indexOf(' ') >= 0;
+};
+const errorOnFileDetection = entries => {
+    if (entries.length > 1) {
+        console.log(i18n.__('searchingDirectoryScan'));
+        for (let file in entries) {
+            console.log('-', entries[file]);
+        }
+        console.log('');
+        console.log(i18n.__('specifyFileScanError'));
+    }
+    else {
+        console.log(i18n.__('noFileFoundScan'));
+        console.log('');
+        console.log(i18n.__('specifyFileScanError'));
+    }
+    process.exit(1);
+};
+const assignLanguage = (entries, configToUse) => {
+    let split = entries[0].split('.');
+    const fileType = split[split.length - 1];
+    if (fileType === 'war' || fileType === 'jar') {
+        console.log('Language is Java');
+        configToUse.language = 'JAVA';
+    }
+    else if (fileType === 'dll') {
+        console.log('Language is Dotnet');
+        configToUse.language = 'DOTNET';
+    }
+    else if (fileType === 'js') {
+        console.log('Language is Javascript');
+        configToUse.language = supportedLanguages.JAVASCRIPT;
+    }
+    else if (fileType === 'zip') {
+        if (configToUse.language !== supportedLanguages.JAVASCRIPT) {
+            console.log(i18n.__('zipErrorScan'));
+            process.exit(1);
+        }
+        console.log('Language is Javascript within zip file');
+    }
+    else {
+        console.log(i18n.__('unknownFileErrorScan'));
+        process.exit(1);
+    }
+};
+module.exports = {
+    autoDetectFileAndLanguage,
+    assignLanguage,
+    errorOnFileDetection
+};

package/dist/scan/fileFinder.js

@@ -0,0 +1,15 @@
+'use strict'
+const fg = require('fast-glob')
+const i18n = require('i18n')
+const findFile = async () => {
+  console.log(i18n.__('searchingScanFileDirectory', process.cwd()))
+  const entries = fg(['**/*.jar', '**/*.war', '**/*.zip', '**/*.dll'], {
+    dot: false,
+    deep: 3,
+    onlyFiles: true
+  })
+  return entries
+}
+module.exports = {
+  findFile
+}

package/dist/scan/fileUtils.js

@@ -0,0 +1,31 @@
+"use strict";
+const fg = require('fast-glob');
+const fs = require('fs');
+const i18n = require('i18n');
+const findFile = async () => {
+    console.log(i18n.__('searchingScanFileDirectory', process.cwd()));
+    return fg(['**/*.jar', '**/*.war', '**/*.zip', '**/*.dll'], {
+        dot: false,
+        deep: 3,
+        onlyFiles: true
+    });
+};
+const checkFilePermissions = file => {
+    let readableFile = false;
+    try {
+        fs.accessSync(file, fs.constants.R_OK);
+        return (readableFile = true);
+    }
+    catch (err) {
+        console.log('Invalid permissions found on ', file);
+        process.exit(0);
+    }
+};
+const fileExists = path => {
+    return fs.existsSync(path);
+};
+module.exports = {
+    findFile,
+    fileExists,
+    checkFilePermissions
+};

package/dist/scan/help.js

@@ -0,0 +1,68 @@
+"use strict";
+const commandLineUsage = require('command-line-usage');
+const i18n = require('i18n');
+const scanUsageGuide = commandLineUsage([
+    {
+        header: i18n.__('scanHeader')
+    },
+    {
+        header: i18n.__('constantsPrerequisitesHeader'),
+        content: [
+            '{bold ' + i18n.__('constantsPrerequisitesContentScanLanguages') + '}',
+            i18n.__('constantsPrerequisitesContent'),
+            '',
+            i18n.__('constantsUsageCommandInfo'),
+            i18n.__('constantsUsageCommandInfo24Hours')
+        ]
+    },
+    {
+        header: i18n.__('constantsScanOptions'),
+        content: [
+            {
+                name: i18n.__('scanOptionsFileName'),
+                summary: '{italic ' +
+                    i18n.__('constantsOptional') +
+                    '}: ' +
+                    i18n.__('scanOptionsFileNameSummary')
+            },
+            {
+                name: i18n.__('scanOptionsLanguage'),
+                summary: '{italic ' +
+                    i18n.__('constantsOptional') +
+                    '}: ' +
+                    i18n.__('scanOptionsLanguageSummaryOptional') +
+                    '{italic ' +
+                    i18n.__('constantsRequired') +
+                    '}: ' +
+                    i18n.__('scanOptionsLanguageSummaryRequired')
+            },
+            {
+                name: i18n.__('scanOptionsName'),
+                summary: '{italic ' +
+                    i18n.__('constantsOptional') +
+                    '}: ' +
+                    i18n.__('scanOptionsNameSummary')
+            },
+            {
+                name: i18n.__('scanOptionsTimeout'),
+                summary: '{italic ' +
+                    i18n.__('constantsOptional') +
+                    '}: ' +
+                    i18n.__('scanOptionsTimeoutSummary')
+            },
+            {
+                name: i18n.__('scanOptionsVerbose'),
+                summary: '{italic ' +
+                    i18n.__('constantsOptional') +
+                    '}: ' +
+                    i18n.__('scanOptionsVerboseSummary')
+            }
+        ]
+    },
+    {
+        content: '{underline https://www.contrastsecurity.com}'
+    }
+]);
+module.exports = {
+    scanUsageGuide
+};

package/dist/scan/populateProjectIdAndProjectName.js

@@ -0,0 +1,55 @@
+"use strict";
+const commonApi = require('../utils/commonApi.js');
+const i18n = require('i18n');
+const populateProjectId = async (config) => {
+    const client = commonApi.getHttpClient(config);
+    let proj = await createProjectId(config, client);
+    if (proj === undefined) {
+        proj = await getExistingProjectIdByName(config, client).then(res => {
+            return res;
+        });
+    }
+    return proj;
+};
+const createProjectId = async (config, client) => {
+    return client
+        .createProjectId(config)
+        .then(res => {
+        if (res.statusCode === 409) {
+            console.log(i18n.__('foundExistingProjectScan'));
+            return;
+        }
+        if (res.statusCode === 201) {
+            console.log(i18n.__('projectCreatedScan'));
+            if (config.verbose) {
+                console.log(i18n.__('populateProjectIdMessage', res.body.id));
+            }
+            return res.body.id;
+        }
+    })
+        .catch(err => {
+        if (config.verbose) {
+            console.log(err);
+        }
+        console.log(i18n.__('connectionError'));
+        process.exit(0);
+    });
+};
+const getExistingProjectIdByName = async (config, client) => {
+    return client
+        .getProjectIdByName(config)
+        .then(res => {
+        if (res.statusCode === 200) {
+            if (config.verbose) {
+                console.log(i18n.__('populateProjectIdMessage', res.body.content[0].id));
+            }
+            return res.body.content[0].id;
+        }
+    })
+        .catch(err => {
+        console.log(err);
+    });
+};
+module.exports = {
+    populateProjectId: populateProjectId
+};

package/dist/scan/scan.js

@@ -0,0 +1,96 @@
+"use strict";
+const commonApi = require('../utils/commonApi.js');
+const fileUtils = require('../scan/fileUtils');
+const allowedFileTypes = ['.jar', '.war', '.js', '.zip'];
+const i18n = require('i18n');
+const AdmZip = require('adm-zip');
+const oraWrapper = require('../utils/oraWrapper');
+const { supportedLanguages } = require('../constants/constants');
+const isFileAllowed = scanOption => {
+    let valid = false;
+    allowedFileTypes.forEach(fileType => {
+        if (scanOption.endsWith(fileType)) {
+            valid = true;
+        }
+    });
+    return valid;
+};
+const sendScan = async (config) => {
+    if (!isFileAllowed(config.file)) {
+        console.log(i18n.__('scanErrorFileMessage'));
+        process.exit(9);
+    }
+    else {
+        fileUtils.checkFilePermissions(config.file);
+        const client = commonApi.getHttpClient(config);
+        const startUploadSpinner = oraWrapper.returnOra(i18n.__('uploadingScan'));
+        oraWrapper.startSpinner(startUploadSpinner);
+        return await client
+            .sendArtifact(config)
+            .then(res => {
+            if (res.statusCode === 201) {
+                oraWrapper.succeedSpinner(startUploadSpinner, i18n.__('uploadingScanSuccessful'));
+                if (config.verbose) {
+                    console.log(i18n.__('responseMessage', res.body));
+                }
+                return res.body.id;
+            }
+            else {
+                oraWrapper.failSpinner(startUploadSpinner, i18n.__('uploadingScanFail'));
+                process.exit(1);
+            }
+        })
+            .catch(err => {
+            console.log(err);
+        });
+    }
+};
+const zipValidator = configToUse => {
+    if (configToUse.file.endsWith('.zip')) {
+        let zipFileName = configToUse.file.split('/').pop();
+        try {
+            let zip = new AdmZip(configToUse.file);
+            let zipEntries = zip.getEntries();
+            zipEntries.forEach(function (zipEntry) {
+                if (!zipEntry.entryName.includes('._') &&
+                    !zipEntry.entryName.includes('/.')) {
+                    if (!zipEntry.isDirectory) {
+                        if (!zipEntry.entryName.endsWith('.js')) {
+                            console.log(i18n.__('scanZipError', zipFileName));
+                            process.exit(1);
+                        }
+                    }
+                }
+            });
+            configToUse.language = supportedLanguages.JAVASCRIPT;
+        }
+        catch {
+            console.log(i18n.__('zipFileException'));
+        }
+    }
+};
+const formatScanOutput = (overview, results) => {
+    console.log();
+    console.log('Here are your top priorities to fix');
+    console.log();
+    results.content.forEach(entry => {
+        console.log(entry.severity, 'ID:', entry.id);
+        console.log(entry.ruleId, 'in', entry.locations[0]?.physicalLocation.artifactLocation.uri, '@', entry.codeFlows[0]?.threadFlows[0]?.locations[0]?.location
+            ?.physicalLocation?.region?.startLine);
+        console.log();
+    });
+    const totalVulnerabilities = overview.critical +
+        overview.high +
+        overview.medium +
+        overview.low +
+        overview.note;
+    console.log(`Found ${totalVulnerabilities} vulnerabilities`);
+    console.log(i18n.__('foundDetailedVulnerabilities', overview.critical, overview.high, overview.medium, overview.low, overview.note));
+};
+module.exports = {
+    sendScan: sendScan,
+    allowedFileTypes: allowedFileTypes,
+    isFileAllowed: isFileAllowed,
+    formatScanOutput: formatScanOutput,
+    zipValidator: zipValidator
+};

package/dist/scan/scanController.js

@@ -0,0 +1,54 @@
+"use strict";
+const i18n = require('i18n');
+const { returnOra, startSpinner, succeedSpinner } = require('../utils/oraWrapper');
+const populateProjectIdAndProjectName = require('./populateProjectIdAndProjectName');
+const scan = require('./scan');
+const scanResults = require('./scanResults');
+const autoDetection = require('./autoDetection');
+const paramHandler = require('../utils/paramsUtil/paramHandler');
+const fileFunctions = require('./fileUtils');
+const getTimeout = config => {
+    if (config.timeout) {
+        return config.timeout;
+    }
+    else {
+        if (config.verbose) {
+            console.log('Timeout set to 5 minutes');
+        }
+        return 300;
+    }
+};
+const startScan = async () => {
+    let paramsAuth = paramHandler.getAuth();
+    let getScanSubCommands = paramHandler.getScanSubCommands();
+    const configToUse = { ...paramsAuth, ...getScanSubCommands };
+    if (configToUse.file === undefined || configToUse.file === null) {
+        await autoDetection.autoDetectFileAndLanguage(configToUse);
+    }
+    else {
+        if (fileFunctions.fileExists(configToUse.file)) {
+            scan.zipValidator(configToUse);
+            autoDetection.assignLanguage([configToUse.file], configToUse);
+        }
+        else {
+            console.log(i18n.__('fileNotExist'));
+            process.exit(0);
+        }
+    }
+    if (!configToUse.projectId) {
+        configToUse.projectId = await populateProjectIdAndProjectName.populateProjectId(configToUse);
+    }
+    const codeArtifactId = await scan.sendScan(configToUse);
+    if (!configToUse.ff) {
+        const startScanSpinner = returnOra('Contrast Scan started');
+        startSpinner(startScanSpinner);
+        const scanDetail = await scanResults.returnScanResults(configToUse, codeArtifactId, getTimeout(configToUse), startScanSpinner);
+        const scanResultsInstances = await scanResults.returnScanResultsInstances(configToUse, scanDetail.id);
+        succeedSpinner(startScanSpinner, 'Contrast Scan complete');
+        const projectOverview = await scanResults.returnScanProjectById(configToUse);
+        return { projectOverview, scanResultsInstances };
+    }
+};
+module.exports = {
+    startScan: startScan
+};

package/dist/scan/scanResults.js

@@ -0,0 +1,85 @@
+"use strict";
+const commonApi = require('../utils/commonApi');
+const requestUtils = require('../../src/utils/requestUtils');
+const i18n = require('i18n');
+const oraFunctions = require('../utils/oraWrapper');
+const getScanId = async (config, codeArtifactId, client) => {
+    return client
+        .getScanId(config, codeArtifactId)
+        .then(res => {
+        return res.body.id;
+    })
+        .catch(err => {
+        console.log(err);
+    });
+};
+const pollScanResults = async (config, scanId, client) => {
+    await requestUtils.sleep(5000);
+    return client
+        .getSpecificScanResult(config, scanId)
+        .then(res => {
+        return res;
+    })
+        .catch(err => {
+        console.log(err);
+    });
+};
+const returnScanResults = async (config, codeArtifactId, timeout, startScanSpinner) => {
+    const client = commonApi.getHttpClient(config);
+    let scanId = await getScanId(config, codeArtifactId, client);
+    let startTime = new Date();
+    let complete = false;
+    while (!complete) {
+        let result = await pollScanResults(config, scanId, client);
+        if (JSON.stringify(result.statusCode) == 200) {
+            if (result.body.status === 'COMPLETED') {
+                complete = true;
+                return result.body;
+            }
+            if (result.body.status === 'FAILED') {
+                complete = true;
+                oraFunctions.failSpinner(startScanSpinner, 'Contrast Scan Failed.');
+                process.exit(1);
+            }
+        }
+        let endTime = new Date() - startTime;
+        if (requestUtils.millisToSeconds(endTime) > timeout) {
+            oraFunctions.failSpinner(startScanSpinner, 'Contrast Scan timed out at the specified ' + timeout + ' seconds.');
+            console.log('Please try again, allowing more time.');
+            process.exit(1);
+        }
+    }
+};
+const returnScanResultsInstances = async (config, scanId) => {
+    const client = commonApi.getHttpClient(config);
+    let result;
+    try {
+        result = await client.getScanResultsInstances(config, scanId);
+        if (JSON.stringify(result.statusCode) == 200) {
+            return result.body;
+        }
+    }
+    catch (e) {
+        console.log(e.message.toString());
+    }
+};
+const returnScanProjectById = async (config) => {
+    const client = commonApi.getHttpClient(config);
+    let result;
+    try {
+        result = await client.getScanProjectById(config);
+        if (JSON.stringify(result.statusCode) == 200) {
+            return result.body;
+        }
+    }
+    catch (e) {
+        console.log(e.message.toString());
+    }
+};
+module.exports = {
+    getScanId: getScanId,
+    returnScanResults: returnScanResults,
+    pollScanResults: pollScanResults,
+    returnScanResultsInstances: returnScanResultsInstances,
+    returnScanProjectById: returnScanProjectById
+};

package/dist/utils/commonApi.js

@@ -0,0 +1,45 @@
+"use strict";
+const HttpClient = require('./../common/HTTPClient');
+const { badRequestError, unauthenticatedError, forbiddenError, proxyError, hostWarningError, genericError } = require('../common/errorHandling');
+const handleResponseErrors = (res, api, hostPresent) => {
+    if (res.statusCode === 400) {
+        api === 'catalogue' ? badRequestError(true) : badRequestError(false);
+    }
+    else if (res.statusCode === 401) {
+        unauthenticatedError();
+    }
+    else if (res.statusCode === 403) {
+        forbiddenError();
+    }
+    else if (res.statusCode === 407) {
+        proxyError();
+    }
+    else {
+        hostPresent === false ? hostWarningError() : genericError();
+    }
+};
+const getProtocol = host => {
+    const hasProtocol = host.toLowerCase().includes('https://') ||
+        host.toLowerCase().includes('http://');
+    return hasProtocol ? host : 'https://' + host;
+};
+const getPath = host => {
+    const hasContrastPath = host.toLowerCase().endsWith('/contrast');
+    return hasContrastPath
+        ? host.toLowerCase().substring(0, host.length - 9)
+        : host.replace(/\/*$/, '');
+};
+const getValidHost = host => {
+    const correctProtocol = getProtocol(host);
+    return getPath(correctProtocol);
+};
+const getHttpClient = config => {
+    return new HttpClient(config);
+};
+module.exports = {
+    getPath: getPath,
+    getValidHost: getValidHost,
+    getProtocol: getProtocol,
+    handleResponseErrors: handleResponseErrors,
+    getHttpClient: getHttpClient
+};

package/dist/utils/filterProjectPath.js

@@ -0,0 +1,20 @@
+"use strict";
+const path = require('path');
+function resolveFilePath(filepath) {
+    if (filepath[0] === '~') {
+        return path.join(process.env.HOME, filepath.slice(1));
+    }
+    return filepath;
+}
+const returnProjectPath = () => {
+    if (process.env.PWD !== (undefined || null || 'undefined')) {
+        return process.env.PWD;
+    }
+    else {
+        return process.argv[process.argv.indexOf('--project_path') + 1];
+    }
+};
+module.exports = {
+    returnProjectPath: returnProjectPath,
+    resolveFilePath: resolveFilePath
+};