@contrast/contrast 1.0.16 → 1.0.17

package/src/lambda/lambda.ts

@@ -17,7 +17,7 @@ import ora from '../utils/oraWrapper'
 import { postAnalytics } from './analytics'
 import { LambdaOptions, AnalyticsOption, StatusType, EventType } from './types'
 import { APP_VERSION } from '../constants/constants'
-import chalk from 'chalk'
+import { postRunMessage } from '../common/commonHelp'
 
 type ApiParams = {
   organizationId: string
@@ -116,7 +116,7 @@ const processLambda = async (argv: string[]) => {
       /* ignore */
     })
 
-    postRunMessage()
+    postRunMessage('lambda')
 
     if (errorMsg) {
       process.exit(1)
@@ -225,12 +225,4 @@ const handleLambdaHelp = () => {
   process.exit(0)
 }
 
-const postRunMessage = () => {
-  console.log('\n' + chalk.underline.bold('Other Codesec Features:'))
-  console.log("'contrast scan' to run CodeSec’s industry leading SAST scanner")
-  console.log(
-    "'contrast audit' to find vulnerabilities in your open source dependencies\n"
-  )
-}
-
 export { processLambda, LambdaOptions, ApiParams, getAvailableFunctions }

package/src/scaAnalysis/java/analysis.js

@@ -1,7 +1,10 @@
 const child_process = require('child_process')
+const spawn = require('cross-spawn')
 const path = require('path')
 const i18n = require('i18n')
 const fs = require('fs')
+const readLine = require('readline')
+const paramHandler = require('../../utils/paramsUtil/paramHandler')
 
 const MAVEN = 'maven'
 const GRADLE = 'gradle'
@@ -29,20 +32,23 @@ const determineProjectTypeAndCwd = (files, config) => {
 
 const buildMaven = (config, projectData, timeout) => {
   let cmdStdout
-  let mvn_settings = ''
-
   try {
-    // Allow users to provide a custom location for their settings.xml
+    let command = 'mvn'
+    let args = ['dependency:tree', '-B']
     if (config.mavenSettingsPath) {
-      mvn_settings = ' -s ' + config.mavenSettingsPath
+      args.push('-s')
+      args.push(config.mavenSettingsPath)
     }
-    cmdStdout = child_process.execSync(
-      'mvn dependency:tree -B' + mvn_settings,
-      {
+    // Allow users to provide a custom location for their settings.xml
+
+    cmdStdout = spawn
+      .sync(command, args, {
+        env: process.env,
         cwd: projectData.cwd,
         timeout
-      }
-    )
+      })
+      .stdout.toString()
+
     return cmdStdout.toString()
   } catch (err) {
     throw new Error(
@@ -141,7 +147,34 @@ const getJavaBuildDeps = (config, files) => {
   }
 }
 
+const agreementPrompt = async config => {
+  const rl = readLine.createInterface({
+    input: process.stdin,
+    output: process.stdout
+  })
+
+  return new Promise((resolve, reject) => {
+    rl.question('❔ Do you want to continue? Type Y or N', async input => {
+      if (input.toLowerCase() === 'yes' || input.toLowerCase() === 'y') {
+        config.javaAgreement = paramHandler.setAgreement(true)
+        rl.close()
+        resolve(config)
+      } else if (input.toLowerCase() === 'no' || input.toLowerCase() === 'n') {
+        rl.close()
+        resolve(process.exit(1))
+      } else {
+        rl.close()
+        console.log('Invalid Input: Exiting')
+        resolve(process.exit(1))
+      }
+    })
+  }).catch(e => {
+    throw e
+  })
+}
+
 module.exports = {
   getJavaBuildDeps,
-  determineProjectTypeAndCwd
+  determineProjectTypeAndCwd,
+  agreementPrompt
 }

package/src/scaAnalysis/java/index.js

@@ -4,12 +4,16 @@ const { createJavaTSMessage } = require('../common/formatMessage')
 const {
   parseDependenciesForSCAServices
 } = require('../common/scaParserForGoAndJava')
+const chalk = require('chalk')
+const _ = require('lodash')
 
-const javaAnalysis = (config, languageFiles) => {
+const javaAnalysis = async (config, languageFiles) => {
   languageFiles.JAVA.forEach(file => {
     file.replace('build.gradle.kts', 'build.gradle')
   })
 
+  await getAgreement(config)
+
   const javaDeps = buildJavaTree(config, languageFiles.JAVA)
 
   if (config.experimental) {
@@ -19,11 +23,24 @@ const javaAnalysis = (config, languageFiles) => {
   }
 }
 
+const getAgreement = async config => {
+  console.log(chalk.bold('Java project detected'))
+  console.log(
+    'Java analysis uses maven / gradle which are potentially susceptible to command injection. Be sure that the code you are running Contrast CLI on is trusted before continuing.'
+  )
+  if (_.isNil(!process.env.CI) && _.isNil(!config.javaAgreement)) {
+    console.log('should print')
+    return await analysis.agreementPrompt(config)
+  }
+  return config
+}
+
 const buildJavaTree = (config, files) => {
   const javaBuildDeps = analysis.getJavaBuildDeps(config, files)
   return parseBuildDeps(config, javaBuildDeps)
 }
 
 module.exports = {
-  javaAnalysis
+  javaAnalysis,
+  getAgreement
 }

package/src/scan/autoDetection.js

@@ -1,7 +1,17 @@
 const i18n = require('i18n')
 const fileFinder = require('./fileUtils')
-const rootFile = require('../audit/languageAnalysisEngine/getProjectRootFilenames')
-const path = require('path')
+
+const autoDetectFingerprintInfo = async filePath => {
+  let complexObj = await fileFinder.findAllFiles(filePath)
+  let result = []
+  let count = 0
+  complexObj.forEach(i => {
+    count++
+    result.push({ filePath: i, id: count.toString() })
+  })
+
+  return result
+}
 
 const autoDetectFileAndLanguage = async configToUse => {
   const entries = await fileFinder.findFile()
@@ -88,5 +98,6 @@ module.exports = {
   autoDetectFileAndLanguage,
   errorOnFileDetection,
   autoDetectAuditFilesAndLanguages,
-  errorOnAuditFileDetection
+  errorOnAuditFileDetection,
+  autoDetectFingerprintInfo
 }

package/src/scan/fileUtils.js

@@ -11,6 +11,33 @@ const findFile = async () => {
   })
 }
 
+const findAllFiles = async filePath => {
+  const result = await fg(
+    [
+      '**/pom.xml',
+      '**/build.gradle',
+      '**/build.gradle.kts',
+      '**/package.json',
+      '**/Pipfile',
+      '**/*.csproj',
+      '**/Gemfile',
+      '**/go.mod'
+    ],
+    {
+      dot: false,
+      deep: 2,
+      onlyFiles: true,
+      absolute: true,
+      cwd: filePath ? filePath : process.cwd()
+    }
+  )
+
+  if (result.length > 0) {
+    return result
+  }
+  return []
+}
+
 const findFilesJava = async (languagesFound, filePath) => {
   const result = await fg(
     ['**/pom.xml', '**/build.gradle', '**/build.gradle.kts'],
@@ -159,5 +186,6 @@ module.exports = {
   findFilesPhp,
   findFilesRuby,
   findFilesDotNet,
-  fileIsEmpty
+  fileIsEmpty,
+  findAllFiles
 }

package/src/scan/help.js

@@ -36,7 +36,8 @@ const scanUsageGuide = commandLineUsage([
       'application-name'
     ]
   },
-  commonHelpLinks()
+  commonHelpLinks()[0],
+  commonHelpLinks()[1]
 ])
 
 module.exports = {

package/src/scan/saveResults.js

@@ -3,7 +3,7 @@ const fs = require('fs')
 const writeResultsToFile = async (responseBody, name = 'results.sarif') => {
   try {
     fs.writeFileSync(name, JSON.stringify(responseBody, null, 2))
-    console.log(`Scan Results saved to ${name}`)
+    return name
   } catch (err) {
     console.log('Error writing Scan Results to file')
   }

package/src/utils/commonApi.js

@@ -5,7 +5,10 @@ const {
   forbiddenError,
   proxyError,
   genericError,
-  maxAppError
+  maxAppError,
+  snapshotFailureError,
+  vulnerabilitiesFailureError,
+  reportFailureError
 } = require('../common/errorHandling')
 
 const handleResponseErrors = (res, api) => {
@@ -20,6 +23,15 @@ const handleResponseErrors = (res, api) => {
   } else if (res.statusCode === 412) {
     maxAppError()
   } else {
+    if (api === 'snapshot' || api === 'catalogue') {
+      snapshotFailureError()
+    }
+    if (api === 'vulnerabilities') {
+      vulnerabilitiesFailureError()
+    }
+    if (api === 'report') {
+      reportFailureError()
+    }
     console.log(res.statusCode)
     genericError(res)
   }

package/src/utils/generalAPI.js

@@ -1,6 +1,5 @@
 const { featuresTeamServer } = require('./capabilities')
 const semver = require('semver')
-const { handleResponseErrors } = require('../common/errorHandling')
 const commonApi = require('./commonApi')
 const { isNil } = require('lodash')
 
@@ -12,7 +11,7 @@ const getGlobalProperties = async config => {
       if (res.statusCode === 200) {
         return res.body
       } else {
-        handleResponseErrors(res, 'globalProperties')
+        commonApi.handleResponseErrors(res, 'globalProperties')
       }
     })
     .catch(err => {

package/src/utils/getConfig.ts

@@ -8,6 +8,7 @@ type ContrastConfOptions = Partial<{
   orgId: string
   authHeader: string
   numOfRuns: number
+  javaAgreement: boolean
 }>
 
 type ContrastConf = Conf<ContrastConfOptions>

package/src/utils/paramsUtil/configStoreParams.js

@@ -16,4 +16,17 @@ const getAuth = () => {
   return ContrastConfToUse
 }
 
-module.exports = { getAuth: getAuth }
+const getAgreement = () => {
+  const ContrastConf = config.localConfig(APP_NAME, APP_VERSION)
+  let ContrastConfToUse = {}
+  ContrastConfToUse.javaAgreement = ContrastConf.get('javaAgreement')
+  return ContrastConfToUse
+}
+
+const setAgreement = agreement => {
+  const ContrastConf = config.localConfig(APP_NAME, APP_VERSION)
+  ContrastConf.set('javaAgreement', agreement)
+  return agreement
+}
+
+module.exports = { getAuth, getAgreement, setAgreement }

package/src/utils/paramsUtil/paramHandler.js

@@ -21,4 +21,12 @@ const getAuth = params => {
   }
 }
 
-module.exports = { getAuth: getAuth }
+const getAgreement = () => {
+  return configStoreParams.getAgreement()
+}
+
+const setAgreement = answer => {
+  return configStoreParams.setAgreement(answer)
+}
+
+module.exports = { getAuth, getAgreement, setAgreement }

package/src/utils/saveFile.js

@@ -8,7 +8,8 @@ const saveScanFile = async (config, scanResults) => {
     const scanId = scanResults.scanDetail.id
     const client = commonApi.getHttpClient(config)
     const rawResults = await client.getSpecificScanResultSarif(config, scanId)
-    await saveResults.writeResultsToFile(rawResults?.body)
+    const name = await saveResults.writeResultsToFile(rawResults?.body)
+    console.log(`Scan Results saved to ${name}`)
   } else {
     console.log(i18n.__('scanNoFiletypeSpecifiedForSave'))
   }

package/src/commands/audit/auditConfig.ts

@@ -1,21 +0,0 @@
-import paramHandler from '../../utils/paramsUtil/paramHandler'
-import constants from '../../cliConstants'
-import { getCommandLineArgsCustom } from '../../utils/parsedCLIOptions'
-import { ContrastConf } from '../../utils/getConfig'
-
-export const getAuditConfig = async (
-  contrastConf: ContrastConf,
-  command: string,
-  argv: string[]
-): Promise<{ [key: string]: string }> => {
-  const auditParameters = await getCommandLineArgsCustom(
-    contrastConf,
-    command,
-    argv,
-    constants.commandLineDefinitions.auditOptionDefinitions
-  )
-  const paramsAuth = paramHandler.getAuth(auditParameters)
-
-  // @ts-ignore
-  return { ...paramsAuth, ...auditParameters }
-}

package/src/commands/audit/processAudit.ts

@@ -1,40 +0,0 @@
-import { getAuditConfig } from './auditConfig'
-import { auditUsageGuide } from './help'
-import { processSca } from '../scan/sca/scaAnalysis'
-import { sendTelemetryConfigAsObject } from '../../telemetry/telemetry'
-import { ContrastConf } from '../../utils/getConfig'
-import chalk from 'chalk'
-
-export type parameterInput = string[]
-
-export const processAudit = async (
-  contrastConf: ContrastConf,
-  argv: parameterInput
-) => {
-  if (argv.indexOf('--help') != -1) {
-    printHelpMessage()
-    process.exit(0)
-  }
-
-  const config = await getAuditConfig(contrastConf, 'audit', argv)
-  await processSca(config)
-  postRunMessage()
-  await sendTelemetryConfigAsObject(
-    config,
-    'audit',
-    argv,
-    'SUCCESS',
-    // @ts-ignore
-    config.language
-  )
-}
-
-const printHelpMessage = () => {
-  console.log(auditUsageGuide)
-}
-
-const postRunMessage = () => {
-  console.log('\n' + chalk.underline.bold('Other Codesec Features:'))
-  console.log("'contrast scan' to run CodeSec’s industry leading SAST scanner")
-  console.log("'contrast lambda' to secure your AWS serverless functions\n")
-}

package/src/common/commonHelp.ts

@@ -1,13 +0,0 @@
-import i18n from 'i18n'
-
-export function commonHelpLinks() {
-  return {
-    header: i18n.__('commonHelpHeader'),
-    content: [
-      i18n.__('commonHelpCheckOutHeader') + i18n.__('commonHelpCheckOutText'),
-      i18n.__('commonHelpLearnMoreHeader') + i18n.__('commonHelpLearnMoreText'),
-      i18n.__('commonHelpJoinDiscussionHeader') +
-        i18n.__('commonHelpJoinDiscussionText')
-    ]
-  }
-}