@contrast/contrast 1.0.10 → 1.0.13

package/src/scaAnalysis/php/phpNewServicesMapper.js

@@ -0,0 +1,77 @@
+const { keyBy, merge } = require('lodash')
+
+const parsePHPLockFileForScaServices = phpLockFile => {
+  const packages = keyBy(phpLockFile.packages, 'name')
+  const packagesDev = keyBy(phpLockFile['packages-dev'], 'name')
+
+  return merge(buildDepTree(packages, true), buildDepTree(packagesDev, false))
+}
+
+const buildDepTree = (packages, isProduction) => {
+  //builds deps into flat structure
+  const dependencyTree = {}
+
+  for (const packagesKey in packages) {
+    const currentObj = packages[packagesKey]
+    const { group, name } = findGroupAndName(currentObj.name)
+
+    const key = `${group}/${name}@${currentObj.version}`
+    dependencyTree[key] = {
+      group: group,
+      name: name,
+      version: currentObj.version,
+      directDependency: true,
+      isProduction: isProduction,
+      dependencies: []
+    }
+
+    const mergedChildDeps = merge(
+      buildSubDepsIntoFlatStructure(currentObj.require),
+      buildSubDepsIntoFlatStructure(currentObj['require-dev'])
+    )
+
+    for (const childKey in mergedChildDeps) {
+      const { group, name } = findGroupAndName(childKey)
+      const builtKey = `${group}/${name}`
+      dependencyTree[builtKey] = mergedChildDeps[childKey]
+    }
+  }
+  return dependencyTree
+}
+
+// currently sub deps will be built into a flat structure
+// but not ingested via the new services as they do not have concrete versions
+const buildSubDepsIntoFlatStructure = childDeps => {
+  const dependencyTree = {}
+
+  for (const dep in childDeps) {
+    const version = childDeps[dep]
+    const { group, name } = findGroupAndName(dep)
+    const key = `${group}/${name}`
+    dependencyTree[key] = {
+      group: group,
+      name: name,
+      version: version,
+      directDependency: false,
+      isProduction: false,
+      dependencies: []
+    }
+  }
+  return dependencyTree
+}
+
+const findGroupAndName = groupAndName => {
+  if (groupAndName.includes('/')) {
+    const groupName = groupAndName.split('/')
+    return { group: groupName[0], name: groupName[1] }
+  } else {
+    return { group: groupAndName, name: groupAndName }
+  }
+}
+
+module.exports = {
+  parsePHPLockFileForScaServices,
+  buildDepTree,
+  buildSubDepsIntoFlatStructure,
+  findGroupAndName
+}

package/src/scaAnalysis/python/analysis.js

@@ -1,5 +1,6 @@
 const multiReplace = require('string-multiple-replace')
 const fs = require('fs')
+const i18n = require('i18n')
 
 const readAndParseProjectFile = file => {
   const filePath = filePathForWindows(file + '/Pipfile')
@@ -23,12 +24,52 @@ const readAndParseLockFile = file => {
   return parsedPipLock
 }
 
-const getPythonDeps = config => {
+const readLockFile = file => {
+  const filePath = filePathForWindows(file + '/Pipfile.lock')
+  const lockFile = fs.readFileSync(filePath, 'utf8')
+  let parsedPipLock = JSON.parse(lockFile)
+  return parsedPipLock['default']
+}
+
+const scaPythonParser = pythonDependencies => {
+  let pythonParsedDeps = {}
+  for (let key in pythonDependencies) {
+    pythonParsedDeps[key] = {}
+    pythonParsedDeps[key].version = pythonDependencies[key].version.replace(
+      '==',
+      ''
+    )
+    pythonParsedDeps[key].group = null
+    pythonParsedDeps[key].name = key
+    pythonParsedDeps[key].isProduction = true
+    pythonParsedDeps[key].dependencies = []
+    pythonParsedDeps[key].directDependency = true
+  }
+  return pythonParsedDeps
+}
+
+const checkForCorrectFiles = languageFiles => {
+  if (!languageFiles.includes('Pipfile.lock')) {
+    throw new Error(i18n.__('languageAnalysisHasNoLockFile', 'python'))
+  }
+
+  if (!languageFiles.includes('Pipfile')) {
+    throw new Error(i18n.__('languageAnalysisProjectFileError', 'python'))
+  }
+}
+
+const getPythonDeps = (config, languageFiles) => {
   try {
-    const parseProject = readAndParseProjectFile(config.file)
-    const parsePip = readAndParseLockFile(config.file)
+    if (config.experimental) {
+      let pythonLockFileContents = readLockFile(config.file)
+      return scaPythonParser(pythonLockFileContents)
+    } else {
+      checkForCorrectFiles(languageFiles)
+      const parseProject = readAndParseProjectFile(config.file)
+      const parsePip = readAndParseLockFile(config.file)
 
-    return { pipfileLock: parsePip, pipfilDependanceies: parseProject }
+      return { pipfileLock: parsePip, pipfilDependanceies: parseProject }
+    }
   } catch (err) {
     console.log(err.message.toString())
     process.exit(1)
@@ -44,6 +85,9 @@ const filePathForWindows = path => {
 
 module.exports = {
   getPythonDeps,
+  scaPythonParser,
+  readAndParseLockFile,
   readAndParseProjectFile,
-  readAndParseLockFile
+  checkForCorrectFiles,
+  readLockFile
 }

package/src/scaAnalysis/python/index.js

@@ -1,9 +1,14 @@
 const { createPythonTSMessage } = require('../common/formatMessage')
-const { getPythonDeps } = require('./analysis')
+const { getPythonDeps, secondaryParser } = require('./analysis')
 
 const pythonAnalysis = (config, languageFiles) => {
   const pythonDeps = getPythonDeps(config, languageFiles.PYTHON)
-  return createPythonTSMessage(pythonDeps)
+
+  if (config.experimental) {
+    return pythonDeps
+  } else {
+    return createPythonTSMessage(pythonDeps)
+  }
 }
 
 module.exports = {

package/src/scaAnalysis/ruby/analysis.js

@@ -1,4 +1,26 @@
 const fs = require('fs')
+const i18n = require('i18n')
+
+const getRubyDeps = (config, languageFiles) => {
+  try {
+    checkForCorrectFiles(languageFiles)
+    const parsedGem = readAndParseGemfile(config.file)
+    const parsedLock = readAndParseGemLockFile(config.file)
+    if (config.experimental) {
+      const rubyArray = removeRedundantAndPopulateDefinedElements(
+        parsedLock.sources
+      )
+      let rubyTree = createRubyTree(rubyArray)
+      findChildrenDependencies(rubyTree)
+      processRootDependencies(parsedLock.dependencies, rubyTree)
+      return rubyTree
+    } else {
+      return { gemfilesDependanceies: parsedGem, gemfileLock: parsedLock }
+    }
+  } catch (err) {
+    throw err
+  }
+}
 
 const readAndParseGemfile = file => {
   const gemFile = fs.readFileSync(file + '/Gemfile', 'utf8')
@@ -241,15 +263,128 @@ const buildSourceDependencyWithVersion = (
   return dependencies
 }
 
-const getRubyDeps = config => {
-  try {
-    const parsedGem = readAndParseGemfile(config.file)
-    const parsedLock = readAndParseGemLockFile(config.file)
+const processRootDependencies = (rootDependencies, rubyTree) => {
+  const getParentObjectByName = queryToken =>
+    Object.values(rubyTree).filter(({ name }) => name === queryToken)
 
-    return { gemfilesDependanceies: parsedGem, gemfileLock: parsedLock }
-  } catch (err) {
-    console.log(err.message)
-    process.exit(1)
+  for (let parent in rootDependencies) {
+    let parentObject = getParentObjectByName(parent)
+
+    // ignore root dependencies that don't have a resolved version
+    if (parentObject[0]) {
+      let gav =
+        parentObject[0].group +
+        '/' +
+        parentObject[0].name +
+        '@' +
+        parentObject[0].version
+
+      rubyTree[gav] = parentObject[0]
+      rubyTree[gav].directDependency = true
+    }
+  }
+  return rubyTree
+}
+
+const createRubyTree = rubyArray => {
+  let rubyTree = {}
+  for (let x in rubyArray) {
+    let version = rubyArray[x].resolved
+
+    let gav = rubyArray[x].group + '/' + rubyArray[x].name + '@' + version
+    rubyTree[gav] = rubyArray[x]
+    rubyTree[gav].directDependency = false
+    rubyTree[gav].version = version
+
+    // add dependency array if none exists
+    if (!rubyTree[gav].dependencies) {
+      rubyTree[gav].dependencies = []
+    }
+
+    delete rubyTree[gav].resolved
+  }
+  return rubyTree
+}
+
+const findChildrenDependencies = rubyTree => {
+  for (let dep in rubyTree) {
+    let unResolvedChildDepsKey = Object.keys(rubyTree[dep].dependencies)
+    rubyTree[dep].dependencies = resolveVersionOfChildDependencies(
+      unResolvedChildDepsKey,
+      rubyTree
+    )
+  }
+}
+
+const resolveVersionOfChildDependencies = (
+  unResolvedChildDepsKey,
+  rubyObject
+) => {
+  const getParentObjectByName = queryToken =>
+    Object.values(rubyObject).filter(({ name }) => name === queryToken)
+  let resolvedChildrenDependencies = []
+  for (let childDep in unResolvedChildDepsKey) {
+    let childDependencyName = unResolvedChildDepsKey[childDep]
+    let parent = getParentObjectByName(childDependencyName)
+    resolvedChildrenDependencies.push(
+      'null/' + childDependencyName + '@' + parent[0].version
+    )
+  }
+  return resolvedChildrenDependencies
+}
+
+const removeRedundantAndPopulateDefinedElements = deps => {
+  return deps.map(element => {
+    if (element.sourceType === 'GIT') {
+      delete element.sourceType
+      delete element.remote
+      delete element.platform
+
+      element.group = null
+      element.isProduction = true
+    }
+
+    if (element.sourceType === 'GEM') {
+      element.group = null
+      element.isProduction = true
+
+      delete element.sourceType
+      delete element.remote
+      delete element.platform
+    }
+
+    if (element.sourceType === 'PATH') {
+      element.group = null
+      element.isProduction = true
+
+      delete element.platform
+      delete element.sourceType
+      delete element.remote
+    }
+
+    if (element.sourceType === 'BUNDLED WITH') {
+      element.group = null
+      element.isProduction = true
+
+      delete element.sourceType
+      delete element.remote
+      delete element.branch
+      delete element.revision
+      delete element.depthLevel
+      delete element.specs
+      delete element.platform
+    }
+    return element
+  })
+}
+
+const checkForCorrectFiles = languageFiles => {
+  if (!languageFiles.includes('Gemfile.lock')) {
+    throw new Error(i18n.__('languageAnalysisHasNoLockFile', 'ruby'))
+  }
+
+  if (!languageFiles.includes('Gemfile')) {
+    throw new Error(i18n.__('languageAnalysisProjectFileError', 'ruby'))
   }
 }
 
@@ -269,5 +404,10 @@ module.exports = {
   getVersion,
   getPatchLevel,
   formatSourceArr,
-  getSourceArray
+  getSourceArray,
+  checkForCorrectFiles,
+  removeRedundantAndPopulateDefinedElements,
+  createRubyTree,
+  findChildrenDependencies,
+  processRootDependencies
 }

package/src/scaAnalysis/ruby/index.js

@@ -3,7 +3,12 @@ const { createRubyTSMessage } = require('../common/formatMessage')
 
 const rubyAnalysis = (config, languageFiles) => {
   const rubyDeps = analysis.getRubyDeps(config, languageFiles.RUBY)
-  return createRubyTSMessage(rubyDeps)
+
+  if (config.experimental) {
+    return rubyDeps
+  } else {
+    return createRubyTSMessage(rubyDeps)
+  }
 }
 
 module.exports = {

package/src/scan/formatScanOutput.ts

@@ -62,12 +62,12 @@ export function formatScanOutput(scanResults: ScanResultsModel) {
       })
       let learnRow: string[] = []
       let adviceRow = []
+      const headerColour = chalk.hex(entry.colour)
       const headerRow = [
-        chalk
-          .hex(entry.colour)
-          .bold(`CONTRAST-${count.toString().padStart(3, '0')}`),
-        chalk.hex(entry.colour).bold('-'),
-        chalk.hex(entry.colour).bold(`[${entry.severity}] ${entry.ruleId}`) +
+        headerColour(`CONTRAST-${count.toString().padStart(3, '0')}`),
+        headerColour(`-`),
+        headerColour(`[${entry.severity}] `) +
+          headerColour.bold(`${entry.ruleId}`) +
           entry.message
       ]
 
@@ -104,6 +104,8 @@ export function formatScanOutput(scanResults: ScanResultsModel) {
     })
   }
   printVulnInfo(projectOverview)
+
+  return projectOverview
 }
 
 function printVulnInfo(projectOverview: any) {

package/src/scan/help.js

@@ -1,6 +1,7 @@
 const commandLineUsage = require('command-line-usage')
 const i18n = require('i18n')
 const constants = require('../constants')
+const { commonHelpLinks } = require('../common/commonHelp')
 
 const scanUsageGuide = commandLineUsage([
   {
@@ -35,9 +36,7 @@ const scanUsageGuide = commandLineUsage([
       'application-name'
     ]
   },
-  {
-    content: '{underline https://www.contrastsecurity.com}'
-  }
+  commonHelpLinks()
 ])
 
 module.exports = {

package/src/scan/populateProjectIdAndProjectName.js

@@ -28,7 +28,11 @@ const createProjectId = async (config, client) => {
         process.exit(1)
         return
       }
-
+      if (res.statusCode === 429) {
+        console.log(i18n.__('exceededFreeTier'))
+        process.exit(1)
+        return
+      }
       if (res.statusCode === 201) {
         console.log(i18n.__('projectCreatedScan'))
         if (config.verbose) {

package/src/scan/scan.ts

@@ -47,6 +47,10 @@ export const sendScan = async (config: any) => {
             )
             console.log(i18n.__('genericServiceError', res.statusCode))
           }
+          if (res.statusCode === 429) {
+            console.log(i18n.__('exceededFreeTier'))
+            process.exit(1)
+          }
           if (res.statusCode === 403) {
             console.log(i18n.__('permissionsError'))
             process.exit(1)

package/src/scan/scanConfig.js

@@ -1,13 +1,15 @@
 const paramHandler = require('../utils/paramsUtil/paramHandler')
-const constants = require('../../src/constants.js')
-const parsedCLIOptions = require('../../src/utils/parsedCLIOptions')
+const constants = require('../constants.js')
 const path = require('path')
 const { supportedLanguagesScan } = require('../constants/constants')
 const i18n = require('i18n')
 const { scanUsageGuide } = require('./help')
+const parsedCLIOptions = require('../utils/parsedCLIOptions')
 
-const getScanConfig = argv => {
-  let scanParams = parsedCLIOptions.getCommandLineArgsCustom(
+const getScanConfig = async (contrastConf, command, argv) => {
+  let scanParams = await parsedCLIOptions.getCommandLineArgsCustom(
+    contrastConf,
+    command,
     argv,
     constants.commandLineDefinitions.scanOptionDefinitions
   )

package/src/scan/scanResults.js

@@ -4,11 +4,15 @@ const oraFunctions = require('../utils/oraWrapper')
 const _ = require('lodash')
 const i18n = require('i18n')
 const oraWrapper = require('../utils/oraWrapper')
+const readLine = require('readline')
 
 const getScanId = async (config, codeArtifactId, client) => {
   return client
     .getScanId(config, codeArtifactId)
     .then(res => {
+      if (res.statusCode == 429) {
+        throw new Error(i18n.__('exceededFreeTier'))
+      }
       return res.body.id
     })
     .catch(err => {
@@ -88,13 +92,57 @@ const returnScanResults = async (
           startScanSpinner,
           'Contrast Scan timed out at the specified ' + timeout + ' seconds.'
         )
-        console.log('Please try again, allowing more time.')
-        process.exit(1)
+
+        const isCI = process.env.CONTRAST_CODESEC_CI
+          ? JSON.parse(process.env.CONTRAST_CODESEC_CI.toLowerCase())
+          : false
+        if (!isCI) {
+          const retry = await retryScanPrompt()
+          timeout = retry.timeout
+        } else {
+          console.log('Please try again, allowing more time')
+          process.exit(1)
+        }
       }
     }
   }
 }
 
+const retryScanPrompt = async () => {
+  const rl = readLine.createInterface({
+    input: process.stdin,
+    output: process.stdout
+  })
+
+  return new Promise((resolve, reject) => {
+    requestUtils.timeOutError(30000, reject)
+
+    rl.question(
+      '🔁 Do you want to continue waiting on Scan? [Y/N]\n',
+      async input => {
+        if (input.toLowerCase() === 'yes' || input.toLowerCase() === 'y') {
+          console.log('Continuing wait for Scan')
+          rl.close()
+          resolve({ timeout: 300 })
+        } else if (
+          input.toLowerCase() === 'no' ||
+          input.toLowerCase() === 'n'
+        ) {
+          rl.close()
+          console.log('Contrast Scan Retry Cancelled: Exiting')
+          resolve(process.exit(1))
+        } else {
+          rl.close()
+          console.log('Invalid Input: Exiting')
+          resolve(process.exit(1))
+        }
+      }
+    )
+  }).catch(e => {
+    throw e
+  })
+}
+
 const returnScanResultsInstances = async (config, scanId) => {
   const client = commonApi.getHttpClient(config)
   let result
@@ -118,5 +166,6 @@ module.exports = {
   getScanId: getScanId,
   returnScanResults: returnScanResults,
   pollScanResults: pollScanResults,
-  returnScanResultsInstances: returnScanResultsInstances
+  returnScanResultsInstances: returnScanResultsInstances,
+  retryScanPrompt
 }

package/src/telemetry/telemetry.ts

@@ -0,0 +1,154 @@
+import { getHttpClient } from '../utils/commonApi'
+import * as crypto from 'crypto'
+import { ContrastConf } from '../utils/getConfig'
+
+export const TELEMETRY_CLI_COMMANDS_EVENT = 'CLI_COMMANDS'
+export const TELEMETRY_CLI_TIME_TO_AUTH_EVENT = 'CLI_TIME_TO_AUTH'
+
+export const sendTelemetryConfigAsConfObj = async (
+  config: ContrastConf,
+  command: string,
+  argv: string[],
+  result: string,
+  language: string
+) => {
+  const hostParam = '--host'
+  const hostParamAlias = '-h'
+  const orgIdParam = '--organization-id'
+  const orgIdParamAlias = '-o'
+  const authParam = '--authorization'
+  const apiKeyParam = '--api-key'
+
+  let configToUse
+
+  if (
+    paramExists(argv, hostParam, hostParamAlias) &&
+    paramExists(argv, orgIdParam, orgIdParamAlias) &&
+    paramExists(argv, authParam, null) &&
+    paramExists(argv, apiKeyParam, null)
+  ) {
+    //if the user has passed the values as params
+    configToUse = {
+      host: findParamValueFromArgs(argv, hostParam, hostParamAlias),
+      organizationId: findParamValueFromArgs(argv, orgIdParam, orgIdParamAlias),
+      authorization: findParamValueFromArgs(argv, authParam, null),
+      apiKey: findParamValueFromArgs(argv, apiKeyParam, null)
+    }
+  } else if (
+    config &&
+    config.get('host') &&
+    config.get('organizationId') &&
+    config.get('authorization') &&
+    config.get('apiKey')
+  ) {
+    configToUse = {
+      host: config.get('host')?.slice(0, -1), //slice off extra / in url, will 404 on teamserver if we don't
+      organizationId: config.get('organizationId'),
+      authorization: config.get('authorization'),
+      apiKey: config.get('apiKey')
+    }
+  } else {
+    //return when unable to get config
+    return
+  }
+
+  return await sendTelemetryConfigAsObject(
+    configToUse,
+    command,
+    argv,
+    result,
+    language
+  )
+}
+
+export const sendTelemetryConfigAsObject = async (
+  config: any,
+  command: string,
+  argv: string[],
+  result: string,
+  language: string
+) => {
+  const obfuscatedParams = obfuscateParams(argv)
+
+  const requestBody = {
+    event: TELEMETRY_CLI_COMMANDS_EVENT,
+    details: {
+      ip_address: '',
+      account_name: '',
+      account_host: '',
+      company_domain: '',
+      command: `contrast ${command} ${obfuscatedParams}`,
+      app_id:
+        config && config.applicationId
+          ? sha1Base64Value(config.applicationId)
+          : 'undefined',
+      project_id:
+        config && config.projectId
+          ? sha1Base64Value(config.projectId)
+          : 'undefined',
+      language: language,
+      result: result,
+      additional_info: '',
+      timestamp: new Date().toUTCString()
+    }
+  }
+
+  return await sendTelemetryRequest(config, requestBody)
+}
+
+export const sendTelemetryRequest = async (config: any, requestBody: any) => {
+  const client = getHttpClient(config)
+  return client
+    .postTelemetry(config, requestBody)
+    .then((res: any) => {
+      if (res.statusCode !== 200 && config.debug === true) {
+        console.log('Telemetry failed to send with status', res.statusCode)
+      }
+      return { statusCode: res.statusCode, statusMessage: res.statusMessage }
+    })
+    .catch((err: any) => {
+      return
+    })
+}
+
+export const obfuscateParams = (argv: string[]) => {
+  return argv
+    .join(' ')
+    .replace(/--(authorization [A-Z0-9]+)/gi, '--authorization *****')
+    .replace(/-(o [A-Z0-9-]+)/gi, '-o *****')
+    .replace(/--(organization-id [A-Z0-9-]+)/gi, '--organization-id *****')
+    .replace(/--(api-key [A-Z0-9]+)/gi, '--api-key *****')
+}
+
+export const paramExists = (
+  argv: string[],
+  param: string,
+  paramAlias: string | null
+) => {
+  return argv.find((arg: string) => arg === param || arg === paramAlias)
+}
+
+export const findParamValueFromArgs = (
+  argv: string[],
+  param: string,
+  paramAlias: string | null
+) => {
+  let paramAsValue
+
+  argv.forEach((arg: string, index: number) => {
+    if (
+      arg === param ||
+      (arg === paramAlias &&
+        argv[index + 1] !== undefined &&
+        argv[index + 1] !== null)
+    ) {
+      paramAsValue = argv[index + 1]
+    }
+  })
+
+  return paramAsValue
+}
+
+export const sha1Base64Value = (value: any) => {
+  return crypto.createHash('sha1').update(value).digest('base64')
+}