@contrast/contrast 1.0.10 → 1.0.13

package/src/index.ts

@@ -14,7 +14,7 @@ import {
   isCorrectNodeVersion
 } from './common/versionChecker'
 import { findCommandOnError } from './common/errorHandling'
-
+import { sendTelemetryConfigAsConfObj } from './telemetry/telemetry'
 const {
   commandLineDefinitions: { mainUsageGuide, mainDefinition }
 } = constants
@@ -57,7 +57,7 @@ const start = async () => {
       config.set('numOfRuns', config.get('numOfRuns') + 1)
 
       // @ts-ignore
-      if (config.get('numOfRuns') >= 1) {
+      if (config.get('numOfRuns') >= 10) {
         await findLatestCLIVersion(config)
         config.set('numOfRuns', 0)
       }
@@ -75,11 +75,11 @@ const start = async () => {
       }
 
       if (command === 'scan') {
-        return await processScan(argvMain)
+        return await processScan(config, argvMain)
       }
 
       if (command === 'audit') {
-        return await processAudit(argvMain)
+        return await processAudit(config, argvMain)
       }
 
       if (
@@ -98,10 +98,24 @@ const start = async () => {
           : console.log(
               `Unknown Command: ${command} \nUse --help for the full list`
             )
+        await sendTelemetryConfigAsConfObj(
+          config,
+          command,
+          argvMain,
+          'FAILURE',
+          'undefined'
+        )
       } else {
         console.log(
           `Unknown Command: ${command} \nUse --help for the full list`
         )
+        await sendTelemetryConfigAsConfObj(
+          config,
+          command,
+          argvMain,
+          'FAILURE',
+          'undefined'
+        )
       }
       process.exit(9)
     } else {

package/src/lambda/help.ts

@@ -1,5 +1,6 @@
 import commandLineUsage from 'command-line-usage'
 import i18n from 'i18n'
+import { commonHelpLinks } from '../common/commonHelp'
 
 const lambdaUsageGuide = commandLineUsage([
   {
@@ -80,9 +81,7 @@ const lambdaUsageGuide = commandLineUsage([
       { name: i18n.__('lambdaHelpOption'), summary: i18n.__('helpSummary') }
     ]
   },
-  {
-    content: '{underline https://www.contrastsecurity.com/developer/codesec}'
-  }
+  commonHelpLinks()
 ])
 
 export { lambdaUsageGuide }

package/src/lambda/lambda.ts

@@ -17,6 +17,7 @@ import ora from '../utils/oraWrapper'
 import { postAnalytics } from './analytics'
 import { LambdaOptions, AnalyticsOption, StatusType, EventType } from './types'
 import { APP_VERSION } from '../constants/constants'
+import chalk from 'chalk'
 
 type ApiParams = {
   organizationId: string
@@ -114,6 +115,9 @@ const processLambda = async (argv: string[]) => {
     await postAnalytics(endCommandAnalytics).catch((error: Error) => {
       /* ignore */
     })
+
+    postRunMessage()
+
     if (errorMsg) {
       process.exit(1)
     }
@@ -221,4 +225,12 @@ const handleLambdaHelp = () => {
   process.exit(0)
 }
 
+const postRunMessage = () => {
+  console.log('\n' + chalk.underline.bold('Other Codesec Features:'))
+  console.log("'contrast scan' to run CodeSec’s industry leading SAST scanner")
+  console.log(
+    "'contrast audit' to find vulnerabilities in your open source dependencies\n"
+  )
+}
+
 export { processLambda, LambdaOptions, ApiParams, getAvailableFunctions }

package/src/scaAnalysis/common/scaParserForGoAndJava.js

@@ -0,0 +1,41 @@
+const parseDependenciesForSCAServices = dependencyTreeObject => {
+  let parsedDependencyTree = {}
+  let subDeps
+
+  for (let tree in dependencyTreeObject) {
+    let unParsedDependencyTree = dependencyTreeObject[tree]
+    for (let dependency in unParsedDependencyTree) {
+      subDeps = parseSubDependencies(unParsedDependencyTree[dependency].edges)
+
+      let parsedDependency = {
+        name: unParsedDependencyTree[dependency].artifactID,
+        group: unParsedDependencyTree[dependency].group,
+        version: unParsedDependencyTree[dependency].version,
+        directDependency: unParsedDependencyTree[dependency].type === 'direct',
+        isProduction: true,
+        dependencies: subDeps
+      }
+      parsedDependencyTree[dependency] = parsedDependency
+    }
+  }
+  return parsedDependencyTree
+}
+
+const parseSubDependencies = dependencies => {
+  // converting:
+  // dependencies: {
+  //   'gopkg.in/check.v1@v0.0.0-2': 'gopkg.in/check.v1@v0.0.0-2'
+  // }
+  // to:
+  // dependencies: [ 'gopkg.in/check.v1@v0.0.0-2' ]
+  let subDeps = []
+  for (let x in dependencies) {
+    subDeps.push(dependencies[x])
+  }
+  return subDeps
+}
+
+module.exports = {
+  parseDependenciesForSCAServices,
+  parseSubDependencies
+}

package/src/scaAnalysis/common/scaServicesUpload.js

@@ -0,0 +1,54 @@
+const commonApi = require('../../utils/commonApi')
+const { APP_VERSION } = require('../../constants/constants')
+const requestUtils = require('../../utils/requestUtils')
+
+const scaTreeUpload = async (analysis, config) => {
+  const requestBody = {
+    applicationId: config.applicationId,
+    dependencyTree: analysis,
+    organizationId: config.organizationId,
+    language: 'NODE',
+    tool: {
+      name: 'Contrast Codesec',
+      version: APP_VERSION
+    }
+  }
+
+  const client = commonApi.getHttpClient(config)
+  const reportID = await client
+    .scaServiceIngest(requestBody, config)
+    .then(res => {
+      if (res.statusCode === 201) {
+        return res.body.libraryIngestJobId
+      } else {
+        throw new Error(res.statusCode + ` error ingesting dependencies`)
+      }
+    })
+    .catch(err => {
+      throw err
+    })
+
+  let keepChecking = true
+  while (keepChecking) {
+    keepChecking = await client
+      .scaServiceReportStatus(config, reportID)
+      .then(res => {
+        console.log(res.body)
+        if (res.body.status == 'COMPLETED') {
+          client.scaServiceReport(config, reportID).then(res => {
+            console.log(res.statusCode)
+            console.log(res.body)
+          })
+
+          return (keepChecking = false)
+        } else {
+          return (keepChecking = true)
+        }
+      })
+    await requestUtils.sleep(5000)
+  }
+}
+
+module.exports = {
+  scaTreeUpload
+}

package/src/scaAnalysis/common/treeUpload.js

@@ -2,11 +2,14 @@ const commonApi = require('../../utils/commonApi')
 const { APP_VERSION } = require('../../constants/constants')
 
 const commonSendSnapShot = async (analysis, config) => {
-  const requestBody = {
-    appID: config.applicationId,
-    cliVersion: APP_VERSION,
-    snapshot: analysis
-  }
+  let requestBody = {}
+  config.experimental === true
+    ? (requestBody = sendToSCAServices(config, analysis))
+    : (requestBody = {
+        appID: config.applicationId,
+        cliVersion: APP_VERSION,
+        snapshot: analysis
+      })
 
   const client = commonApi.getHttpClient(config)
   return client
@@ -23,6 +26,19 @@ const commonSendSnapShot = async (analysis, config) => {
     })
 }
 
+const sendToSCAServices = (config, analysis) => {
+  return {
+    applicationId: config.applicationId,
+    dependencyTree: analysis,
+    organizationId: config.organizationId,
+    language: config.language,
+    tool: {
+      name: 'Contrast Codesec',
+      version: APP_VERSION
+    }
+  }
+}
+
 module.exports = {
   commonSendSnapShot
 }

package/src/scaAnalysis/dotnet/analysis.js

@@ -40,9 +40,26 @@ const readAndParseLockFile = lockFilePath => {
   return lockFile
 }
 
+const checkForCorrectFiles = languageFiles => {
+  if (!languageFiles.includes('packages.lock.json')) {
+    throw new Error(i18n.__('languageAnalysisHasNoLockFile', '.NET'))
+  }
+
+  if (!languageFiles.some(i => i.includes('.csproj'))) {
+    throw new Error(i18n.__('languageAnalysisProjectFileError', '.NET'))
+  }
+}
+
 const getDotNetDeps = (filePath, languageFiles) => {
-  const projectFile = readAndParseProjectFile(filePath + `/${languageFiles[0]}`)
-  const lockFile = readAndParseLockFile(filePath + `/${languageFiles[1]}`)
+  checkForCorrectFiles(languageFiles)
+  const projectFileName = languageFiles.find(fileName =>
+    fileName.includes('.csproj')
+  )
+  const lockFileName = languageFiles.find(fileName =>
+    fileName.includes('.json')
+  )
+  const projectFile = readAndParseProjectFile(filePath + `/${projectFileName}`)
+  const lockFile = readAndParseLockFile(filePath + `/${lockFileName}`)
 
   return { projectFile, lockFile }
 }
@@ -50,5 +67,6 @@ const getDotNetDeps = (filePath, languageFiles) => {
 module.exports = {
   getDotNetDeps,
   readAndParseProjectFile,
-  readAndParseLockFile
+  readAndParseLockFile,
+  checkForCorrectFiles
 }

package/src/scaAnalysis/go/goAnalysis.js

@@ -1,14 +1,21 @@
 const { createGoTSMessage } = require('../common/formatMessage')
+const {
+  parseDependenciesForSCAServices
+} = require('../common/scaParserForGoAndJava')
 const goReadDepFile = require('./goReadDepFile')
 const goParseDeps = require('./goParseDeps')
 
-const goAnalysis = (config, languageFiles) => {
+const goAnalysis = config => {
   try {
     const rawGoDependencies = goReadDepFile.getGoDependencies(config)
     const parsedGoDependencies =
       goParseDeps.parseGoDependencies(rawGoDependencies)
 
-    return createGoTSMessage(parsedGoDependencies)
+    if (config.experimental) {
+      return parseDependenciesForSCAServices(parsedGoDependencies)
+    } else {
+      return createGoTSMessage(parsedGoDependencies)
+    }
   } catch (e) {
     console.log(e.message.toString())
   }

package/src/scaAnalysis/java/analysis.js

@@ -6,9 +6,13 @@ const fs = require('fs')
 const MAVEN = 'maven'
 const GRADLE = 'gradle'
 
-const determineProjectTypeAndCwd = (files, file) => {
+const determineProjectTypeAndCwd = (files, config) => {
   const projectData = {}
 
+  if (files.length > 1) {
+    files = files.filter(i => config.fileName.includes(i))
+  }
+
   if (files[0].includes('pom.xml')) {
     projectData.projectType = MAVEN
   } else if (files[0].includes('build.gradle')) {
@@ -16,9 +20,9 @@ const determineProjectTypeAndCwd = (files, file) => {
   }
 
   //clean up the path to be a folder not a file
-  projectData.cwd = file
-    ? file.replace('pom.xml', '').replace('build.gradle', '')
-    : file
+  projectData.cwd = config.file
+    ? config.file.replace('pom.xml', '').replace('build.gradle', '')
+    : config.file
 
   return projectData
 }
@@ -124,7 +128,7 @@ const getJavaBuildDeps = (config, files) => {
   }
 
   try {
-    const projectData = determineProjectTypeAndCwd(files, config.file)
+    const projectData = determineProjectTypeAndCwd(files, config)
     if (projectData.projectType === MAVEN) {
       output.mvnDependancyTreeOutput = buildMaven(config, projectData, timeout)
     } else if (projectData.projectType === GRADLE) {
@@ -138,5 +142,6 @@ const getJavaBuildDeps = (config, files) => {
 }
 
 module.exports = {
-  getJavaBuildDeps
+  getJavaBuildDeps,
+  determineProjectTypeAndCwd
 }

package/src/scaAnalysis/java/index.js

@@ -1,6 +1,9 @@
 const analysis = require('./analysis')
 const { parseBuildDeps } = require('./javaBuildDepsParser')
 const { createJavaTSMessage } = require('../common/formatMessage')
+const {
+  parseDependenciesForSCAServices
+} = require('../common/scaParserForGoAndJava')
 
 const javaAnalysis = (config, languageFiles) => {
   languageFiles.JAVA.forEach(file => {
@@ -8,7 +11,12 @@ const javaAnalysis = (config, languageFiles) => {
   })
 
   const javaDeps = buildJavaTree(config, languageFiles.JAVA)
-  return createJavaTSMessage(javaDeps)
+
+  if (config.experimental) {
+    return parseDependenciesForSCAServices(javaDeps)
+  } else {
+    return createJavaTSMessage(javaDeps)
+  }
 }
 
 const buildJavaTree = (config, files) => {

package/src/scaAnalysis/java/javaBuildDepsParser.js

@@ -14,14 +14,14 @@ const parseBuildDeps = (config, input) => {
 const preParser = shavedOutput => {
   let obj = []
   for (let dep in shavedOutput) {
+    shavedOutput[dep] = shaveDependencyType(shavedOutput[dep])
+
     obj.push(
       shavedOutput[dep]
         .replace('+-', '+---')
         .replace('[INFO]', '')
         .replace('\\-', '\\---')
         .replace(':jar:', ':')
-        .replace(':test', '')
-        .replace(':compile', '')
         .replace(' +', '+')
         .replace(' |', '|')
         .replace(' \\', '\\')
@@ -56,11 +56,29 @@ const preParser = shavedOutput => {
   return depTree
 }
 
+const shaveDependencyType = dep => {
+  if (dep.endsWith('\r')) {
+    dep = dep.slice(0, -1)
+  }
+
+  if (dep.endsWith(':test')) {
+    dep = dep.slice(0, -5)
+  }
+
+  if (dep.endsWith(':compile')) {
+    dep = dep.slice(0, -8)
+  }
+
+  if (dep.endsWith(':provided')) {
+    dep = dep.slice(0, -9)
+  }
+
+  return dep
+}
+
 const shaveOutput = (gradleDependencyTreeOutput, projectType) => {
   let shavedOutput = gradleDependencyTreeOutput.split('\n')
 
-  // console.log(projectType)
-
   if (projectType === 'maven') {
     shavedOutput = preParser(shavedOutput)
   }
@@ -375,7 +393,6 @@ const validateIndentation = shavedOutput => {
 
 const parseGradle = (gradleDependencyTreeOutput, config, projectType) => {
   let shavedOutput = shaveOutput(gradleDependencyTreeOutput, projectType)
-
   if (config.subProject) {
     let subProject = parseSubProject(shavedOutput)
     let validatedOutput = validateIndentation(subProject)
@@ -400,5 +417,7 @@ module.exports = {
   computeRelationToLastElement,
   addIndentation,
   computeLevel,
-  computeIndentation
+  computeIndentation,
+  shaveDependencyType,
+  preParser
 }

package/src/scaAnalysis/javascript/index.js

@@ -1,6 +1,7 @@
 const analysis = require('./analysis')
 const i18n = require('i18n')
 const formatMessage = require('../common/formatMessage')
+const scaServiceParser = require('./scaServiceParser')
 
 const jsAnalysis = async (config, languageFiles) => {
   checkForCorrectFiles(languageFiles)
@@ -13,6 +14,9 @@ const jsAnalysis = async (config, languageFiles) => {
 const buildNodeTree = async (config, files) => {
   let analysis = await readFiles(config, files)
   const rawNode = await parseFiles(config, files, analysis)
+  if (config.experimental) {
+    return scaServiceParser.parseJS(rawNode)
+  }
   return formatMessage.createJavaScriptTSMessage(rawNode)
 }
 

package/src/scaAnalysis/javascript/scaServiceParser.js

@@ -0,0 +1,145 @@
+const parseJS = rawNode => {
+  let dependencyTree = {}
+  let combinedPackageJSONDep = {
+    ...rawNode.packageJSON?.dependencies,
+    ...rawNode.packageJSON?.devDependencies
+  }
+  let analyseLock = chooseLockFile(rawNode)
+
+  if (analyseLock.type === 'yarn') {
+    dependencyTree = yarnCreateDepTree(
+      dependencyTree,
+      combinedPackageJSONDep,
+      analyseLock.lockFile,
+      rawNode
+    )
+  }
+
+  if (analyseLock.type === 'npm') {
+    dependencyTree = npmCreateDepTree(
+      dependencyTree,
+      combinedPackageJSONDep,
+      analyseLock.lockFile,
+      rawNode
+    )
+  }
+
+  return dependencyTree
+}
+
+const npmCreateDepTree = (
+  dependencyTree,
+  combinedPackageJSONDep,
+  packageLock,
+  rawNode
+) => {
+  for (const [key, value] of Object.entries(packageLock)) {
+    dependencyTree[key] = {
+      name: key,
+      version: getResolvedVersion(key, packageLock),
+      group: null,
+      isProduction: checkIfInPackageJSON(rawNode.packageJSON.dependencies, key),
+      directDependency: checkIfInPackageJSON(combinedPackageJSONDep, key),
+      dependencies: createNPMChildDependencies(packageLock, key)
+    }
+  }
+  return dependencyTree
+}
+
+const yarnCreateDepTree = (
+  dependencyTree,
+  combinedPackageJSONDep,
+  packageLock,
+  rawNode
+) => {
+  for (const [key, value] of Object.entries(packageLock)) {
+    let gav = getNameFromGAV(key)
+    let nag = getDepNameWithoutVersion(key)
+    dependencyTree[key] = {
+      name: gav,
+      version: getResolvedVersion(key, packageLock),
+      group: null,
+      isProduction: checkIfInPackageJSON(rawNode.packageJSON.dependencies, nag),
+      directDependency: checkIfInPackageJSON(combinedPackageJSONDep, nag),
+      dependencies: createChildDependencies(packageLock, key)
+    }
+  }
+  return dependencyTree
+}
+
+const chooseLockFile = rawNode => {
+  if (rawNode?.yarn?.yarnLockFile !== undefined) {
+    return { lockFile: rawNode?.yarn?.yarnLockFile?.object, type: 'yarn' }
+  } else if (rawNode.npmLockFile !== undefined) {
+    return { lockFile: rawNode?.npmLockFile?.dependencies, type: 'npm' }
+  } else {
+    return undefined
+  }
+}
+
+const createKeyName = (dep, version) => {
+  return dep + '@' + version
+}
+
+const checkIfInPackageJSON = (list, dep) => {
+  return Object.keys(list).includes(dep)
+}
+
+const createChildDependencies = (lockFileDep, currentDep) => {
+  let depArray = []
+  if (lockFileDep[currentDep]?.dependencies) {
+    for (const [key, value] of Object.entries(
+      lockFileDep[currentDep]?.dependencies
+    )) {
+      depArray.push(createKeyName(key, value))
+    }
+  }
+  return depArray
+}
+
+const createNPMChildDependencies = (lockFileDep, currentDep) => {
+  let depArray = []
+  if (lockFileDep[currentDep]?.requires) {
+    for (const [key, value] of Object.entries(
+      lockFileDep[currentDep]?.requires
+    )) {
+      depArray.push(key)
+    }
+  }
+  return depArray
+}
+
+const getDepNameWithoutVersion = depKey => {
+  let dependency = depKey.split('@')
+  if (dependency.length - 1 > 1) {
+    return '@' + dependency[1]
+  }
+  return dependency[0]
+}
+
+const getNameFromGAV = depKey => {
+  let dependency = depKey.split('/')
+  if (dependency.length == 2) {
+    dependency = getDepNameWithoutVersion(dependency[1])
+    return dependency
+  }
+  if (dependency.length == 1) {
+    dependency = getDepNameWithoutVersion(depKey)
+    return dependency
+  }
+  //what should we do if there's no version? The service will fall over but do we want to throw error for only one wrong version?
+  return depKey
+}
+
+const getResolvedVersion = (depKey, packageLock) => {
+  return packageLock[depKey]?.version
+}
+
+module.exports = {
+  parseJS,
+  checkIfInPackageJSON,
+  getNameFromGAV,
+  getResolvedVersion,
+  chooseLockFile,
+  createNPMChildDependencies
+}

package/src/scaAnalysis/php/analysis.js

@@ -5,7 +5,7 @@ const _ = require('lodash')
 const readFile = (config, nameOfFile) => {
   if (config.file) {
     try {
-      return fs.readFileSync(config.file + '/' + nameOfFile)
+      return fs.readFileSync(config.file + '/' + nameOfFile, 'utf8')
     } catch (error) {
       console.log('Unable to find file')
       console.log(error)

package/src/scaAnalysis/php/index.js

@@ -1,13 +1,19 @@
 const { readFile, parseProjectFiles } = require('./analysis')
 const { createPhpTSMessage } = require('../common/formatMessage')
+const { parsePHPLockFileForScaServices } = require('./phpNewServicesMapper')
 
-const phpAnalysis = (config, files) => {
-  let analysis = readFiles(config, files.PHP)
-  const phpDep = parseProjectFiles(analysis)
-  return createPhpTSMessage(phpDep)
+const phpAnalysis = config => {
+  let analysis = readFiles(config)
+
+  if (config.experimental) {
+    return parsePHPLockFileForScaServices(analysis.rawLockFileContents)
+  } else {
+    const phpDep = parseProjectFiles(analysis)
+    return createPhpTSMessage(phpDep)
+  }
 }
 
-const readFiles = (config, files) => {
+const readFiles = config => {
   let php = {}
 
   php.composerJSON = JSON.parse(readFile(config, 'composer.json'))
@@ -18,5 +24,5 @@ const readFiles = (config, files) => {
 }
 
 module.exports = {
-  phpAnalysis
+  phpAnalysis: phpAnalysis
 }