@contrast/contrast 1.0.17 → 1.0.19

package/src/cliConstants.js

@@ -11,7 +11,7 @@ i18n.configure({
   defaultLocale: 'en'
 })
 
-const sharedOptionDefinitions = [
+const sharedCertOptionDefinitions = [
   {
     name: 'proxy',
     description:
@@ -45,46 +45,55 @@ const sharedOptionDefinitions = [
       i18n.__('constantsProxyCert')
   },
   {
-    name: 'ignore-cert-errors',
+    name: 'cert-self-signed',
     type: Boolean,
     description:
       '{bold ' +
       i18n.__('constantsOptional') +
       '}:' +
-      i18n.__('constantsIgnoreCertErrors')
+      i18n.__('constantsCertSelfSigned')
   }
 ]
 
-// CLI options that we will allow and handle
-const scanOptionDefinitions = [
-  ...sharedOptionDefinitions,
+const sharedConnectionOptionDefinitions = [
   {
-    name: 'name',
-    alias: 'n',
+    name: 'organization-id',
+    alias: 'o',
     description:
       '{bold ' +
-      i18n.__('constantsOptional') +
+      i18n.__('constantsRequiredEnterprise') +
       '}: ' +
-      i18n.__('constantsProjectName')
+      i18n.__('constantsOrganizationId')
   },
   {
-    name: 'language',
-    alias: 'l',
+    name: 'api-key',
     description:
       '{bold ' +
-      i18n.__('constantsOptional') +
+      i18n.__('constantsRequiredEnterprise') +
       '}: ' +
-      i18n.__('scanOptionsLanguageSummary')
+      i18n.__('constantsApiKey')
   },
   {
-    name: 'file',
-    alias: 'f',
+    name: 'authorization',
     description:
       '{bold ' +
-      i18n.__('constantsOptional') +
+      i18n.__('constantsRequiredEnterprise') +
       '}: ' +
-      i18n.__('scanOptionsFileNameSummary')
+      i18n.__('constantsAuthorization')
   },
+  {
+    name: 'host',
+    description:
+      '{bold ' +
+      i18n.__('constantsRequiredEnterprise') +
+      '}: ' +
+      i18n.__('constantsHostId')
+  }
+]
+
+const scanAdvancedOptionDefinitionsForHelp = [
+  ...sharedConnectionOptionDefinitions,
+  ...sharedCertOptionDefinitions,
   {
     name: 'project-id',
     alias: 'p',
@@ -95,55 +104,60 @@ const scanOptionDefinitions = [
       i18n.__('constantsProjectId')
   },
   {
-    name: 'project-path',
+    name: 'language',
+    alias: 'l',
     description:
       '{bold ' +
       i18n.__('constantsOptional') +
       '}: ' +
-      i18n.__('constantsProjectPath')
+      i18n.__('scanOptionsLanguageSummary')
   },
   {
-    name: 'timeout',
-    alias: 't',
-    type: Number,
+    name: 'ff',
+    type: Boolean,
     description:
       '{bold ' +
       i18n.__('constantsOptional') +
       '}: ' +
-      i18n.__('scanOptionsTimeoutSummary')
+      i18n.__('constantsDoNotWaitForScan')
   },
   {
-    name: 'organization-id',
-    alias: 'o',
+    name: 'label',
     description:
-      '{bold ' +
-      i18n.__('constantsRequired') +
-      '}: ' +
-      i18n.__('constantsOrganizationId')
-  },
+      '{bold ' + i18n.__('constantsOptional') + '}:' + i18n.__('scanLabel')
+  }
+]
+
+// CLI options that we will allow and handle
+const scanOptionDefinitions = [
+  ...scanAdvancedOptionDefinitionsForHelp,
   {
-    name: 'api-key',
+    name: 'name',
+    alias: 'n',
     description:
       '{bold ' +
-      i18n.__('constantsRequired') +
+      i18n.__('constantsOptional') +
       '}: ' +
-      i18n.__('constantsApiKey')
+      i18n.__('constantsProjectName')
   },
   {
-    name: 'authorization',
+    name: 'file',
+    alias: 'f',
     description:
       '{bold ' +
-      i18n.__('constantsRequired') +
+      i18n.__('constantsOptional') +
       '}: ' +
-      i18n.__('constantsAuthorization')
+      i18n.__('scanOptionsFileNameSummary')
   },
   {
-    name: 'host',
+    name: 'timeout',
+    alias: 't',
+    type: Number,
     description:
       '{bold ' +
-      i18n.__('constantsRequired') +
+      i18n.__('constantsOptional') +
       '}: ' +
-      i18n.__('constantsHostId')
+      i18n.__('scanOptionsTimeoutSummary')
   },
   {
     name: 'fail',
@@ -163,15 +177,6 @@ const scanOptionDefinitions = [
       '}: ' +
       i18n.__('constantsSeverity')
   },
-  {
-    name: 'ff',
-    type: Boolean,
-    description:
-      '{bold ' +
-      i18n.__('constantsOptional') +
-      '}: ' +
-      i18n.__('constantsDoNotWaitForScan')
-  },
   {
     name: 'verbose',
     alias: 'v',
@@ -188,11 +193,6 @@ const scanOptionDefinitions = [
     description:
       '{bold ' + i18n.__('constantsOptional') + '}:' + i18n.__('constantsSave')
   },
-  {
-    name: 'label',
-    description:
-      '{bold ' + i18n.__('constantsOptional') + '}:' + i18n.__('scanLabel')
-  },
   {
     name: 'help',
     alias: 'h',
@@ -207,18 +207,11 @@ const scanOptionDefinitions = [
     name: 'experimental',
     alias: 'e',
     type: Boolean
-  },
-  {
-    name: 'application-name',
-    description:
-      '{bold ' +
-      i18n.__('constantsOptional') +
-      '}: ' +
-      i18n.__('constantsApplicationName')
   }
 ]
 
 const authOptionDefinitions = [
+  ...sharedConnectionOptionDefinitions,
   {
     name: 'help',
     alias: 'h',
@@ -241,8 +234,9 @@ const configOptionDefinitions = [
   }
 ]
 
-const auditOptionDefinitions = [
-  ...sharedOptionDefinitions,
+const auditAdvancedOptionDefinitionsForHelp = [
+  ...sharedConnectionOptionDefinitions,
+  ...sharedCertOptionDefinitions,
   {
     name: 'application-id',
     description:
@@ -259,39 +253,11 @@ const auditOptionDefinitions = [
       '}: ' +
       i18n.__('constantsApplicationName')
   },
-  {
-    name: 'file',
-    alias: 'f',
-    defaultValue: process.cwd().concat('/'),
-    description:
-      '{bold ' +
-      i18n.__('constantsOptional') +
-      '}: ' +
-      i18n.__('constantsFilePath')
-  },
-  {
-    name: 'fail',
-    type: Boolean,
-    description:
-      '{bold ' +
-      i18n.__('constantsOptional') +
-      '}: ' +
-      i18n.__('failOptionMessage')
-  },
-  {
-    name: 'severity',
-    type: severity => parseSeverity(severity),
-    description:
-      '{bold ' +
-      i18n.__('constantsOptional') +
-      '}: ' +
-      i18n.__('constantsSeverity')
-  },
   {
     name: 'app-groups',
     description:
       '{bold ' +
-      i18n.__('constantsOptionalForCatalogue') +
+      i18n.__('constantsOptional') +
       '}: ' +
       i18n.__('constantsAppGroups')
   },
@@ -322,54 +288,58 @@ const auditOptionDefinitions = [
       '{bold ' + i18n.__('constantsOptional') + '}: ' + i18n.__('constantsCode')
   },
   {
-    name: 'ignore-dev',
-    type: Boolean,
-    alias: 'i',
+    name: 'maven-settings-path',
     description:
       '{bold ' +
       i18n.__('constantsOptional') +
       '}: ' +
-      i18n.__('constantsIgnoreDev')
-  },
-  {
-    name: 'maven-settings-path'
-  },
-  {
-    name: 'fingerprint',
-    type: Boolean
-  },
+      i18n.__('constantsMavenSettingsPath')
+  }
+]
+
+const auditOptionDefinitions = [
+  ...auditAdvancedOptionDefinitionsForHelp,
   {
-    name: 'organization-id',
-    alias: 'o',
+    name: 'file',
+    alias: 'f',
+    defaultValue: process.cwd().concat('/'),
     description:
       '{bold ' +
-      i18n.__('constantsRequired') +
+      i18n.__('constantsOptional') +
       '}: ' +
-      i18n.__('constantsOrganizationId')
+      i18n.__('constantsFilePath')
   },
   {
-    name: 'api-key',
+    name: 'fail',
+    type: Boolean,
     description:
       '{bold ' +
-      i18n.__('constantsRequired') +
+      i18n.__('constantsOptional') +
       '}: ' +
-      i18n.__('constantsApiKey')
+      i18n.__('failOptionMessage')
   },
   {
-    name: 'authorization',
+    name: 'severity',
+    type: severity => parseSeverity(severity),
     description:
       '{bold ' +
-      i18n.__('constantsRequired') +
+      i18n.__('constantsOptional') +
       '}: ' +
-      i18n.__('constantsAuthorization')
+      i18n.__('constantsSeverity')
   },
   {
-    name: 'host',
+    name: 'ignore-dev',
+    type: Boolean,
+    alias: 'i',
     description:
       '{bold ' +
-      i18n.__('constantsRequired') +
+      i18n.__('constantsOptional') +
       '}: ' +
-      i18n.__('constantsHostId')
+      i18n.__('constantsIgnoreDev')
+  },
+  {
+    name: 'fingerprint',
+    type: Boolean
   },
   {
     name: 'save',
@@ -459,6 +429,10 @@ const mainUsageGuide = commandLineUsage([
       { name: i18n.__('helpName'), summary: i18n.__('helpSummary') }
     ]
   },
+  {
+    header: i18n.__('constantsAdvancedOptions'),
+    optionList: sharedCertOptionDefinitions
+  },
   {
     header: i18n.__('configHeader2'),
     content: [
@@ -478,6 +452,8 @@ module.exports = {
     scanOptionDefinitions,
     auditOptionDefinitions,
     authOptionDefinitions,
-    configOptionDefinitions
+    configOptionDefinitions,
+    scanAdvancedOptionDefinitionsForHelp,
+    auditAdvancedOptionDefinitionsForHelp
   }
 }

package/src/commands/audit/help.js

@@ -34,9 +34,12 @@ const auditUsageGuide = commandLineUsage([
       'authorization',
       'host',
       'proxy',
+      'cert',
+      'cacert',
+      'key',
       'help',
       'ff',
-      'ignore-cert-errors',
+      'cert-self-signed',
       'verbose',
       'debug',
       'experimental',
@@ -49,9 +52,15 @@ const auditUsageGuide = commandLineUsage([
       'app-groups',
       'metadata',
       'track',
-      'fingerprint'
+      'fingerprint',
+      'branch'
     ]
   },
+  {
+    header: i18n.__('constantsAdvancedOptions'),
+    optionList:
+      constants.commandLineDefinitions.auditAdvancedOptionDefinitionsForHelp
+  },
   commonHelpLinks()[0],
   commonHelpLinks()[1]
 ])

package/src/commands/auth/auth.js

@@ -1,8 +1,7 @@
 const { v4: uuidv4 } = require('uuid')
-const { setConfigValues } = require('../../utils/getConfig')
-const open = require('open')
+const configFunctions = require('../../utils/getConfig')
 const commonApi = require('../../utils/commonApi')
-const { sleep } = require('../../utils/requestUtils')
+const requestUtils = require('../../utils/requestUtils')
 const i18n = require('i18n')
 const {
   returnOra,
@@ -14,6 +13,9 @@ const { TIMEOUT, AUTH_UI_URL } = require('../../constants/constants')
 const parsedCLIOptions = require('../../utils/parsedCLIOptions')
 const constants = require('../../cliConstants')
 const commandLineUsage = require('command-line-usage')
+const { commonMessageFormatter } = require('../../common/errorHandling')
+const open = require('open')
+const messages = require('../../constants/locales').en_locales()
 
 const processAuth = async (argv, config) => {
   let authParams = await parsedCLIOptions.getCommandLineArgsCustom(
@@ -28,6 +30,15 @@ const processAuth = async (argv, config) => {
     process.exit(0)
   }
 
+  //check if user has entered enterprise credentials
+  if (checkForCustomCredentials(authParams)) {
+    processCustomCredentials(authParams, config)
+  } else {
+    await startAuthProcess(config)
+  }
+}
+
+const startAuthProcess = async config => {
   const token = uuidv4()
   const url = `${AUTH_UI_URL}/?token=${token}`
 
@@ -41,9 +52,8 @@ const processAuth = async (argv, config) => {
 
     const result = await isAuthComplete(token, TIMEOUT, config)
     if (result) {
-      setConfigValues(config, result)
+      configFunctions.setConfigValues(config, result)
     }
-    return
   } finally {
     //spinner stop
   }
@@ -72,7 +82,7 @@ const isAuthComplete = async (token, timeout, config) => {
 }
 
 const pollAuthResult = async (token, client) => {
-  await sleep(5000)
+  await requestUtils.sleep(5000)
   return client
     .pollForAuth(token)
     .then(res => {
@@ -94,6 +104,38 @@ const authUsageGuide = commandLineUsage([
   }
 ])
 
+const checkForCustomCredentials = authParams => {
+  const hasSomeKeys =
+    authParams.apiKey ||
+    authParams.organizationId ||
+    authParams.host ||
+    authParams.authorization
+  const hasAllKeys =
+    authParams.apiKey &&
+    authParams.organizationId &&
+    authParams.host &&
+    authParams.authorization
+
+  if (hasAllKeys) {
+    return true
+  }
+  if (hasSomeKeys) {
+    commonMessageFormatter(messages.authCommand.credentialsMissing, true)
+  }
+  return false
+}
+
+const processCustomCredentials = (authParams, config) => {
+  const valuesToSet = {
+    apiKey: authParams.apiKey,
+    orgId: authParams.organizationId,
+    authHeader: authParams.authorization,
+    host: authParams.host
+  }
+  configFunctions.setConfigValues(config, valuesToSet)
+  commonMessageFormatter(messages.authCommand.credentialsAccepted, false)
+}
+
 module.exports = {
-  processAuth: processAuth
+  processAuth
 }

package/src/commands/scan/sca/scaAnalysis.js

@@ -64,6 +64,8 @@ const processSca = async config => {
       config.file
     )
 
+    autoDetection.dealWithMultiJava(filesFound)
+
     if (filesFound.length > 1 && pathWithFile) {
       filesFound = filesFound.filter(i =>
         Object.values(i)[0].includes(path.basename(config.fileName))

package/src/common/HTTPClient.js

@@ -6,7 +6,7 @@ const { AUTH_CALLBACK_URL } = require('../constants/constants')
 function HTTPClient(config) {
   const apiKey = config.apiKey
   const authToken = config.authorization
-  this.rejectUnauthorized = !config.ignoreCertErrors
+  this.rejectUnauthorized = !config.certSelfSigned
 
   const superApiKey = config.superApiKey
   const superAuthToken = config.superAuthorization
@@ -226,6 +226,7 @@ HTTPClient.prototype.scaServiceIngest = function scaServiceIngest(
   options.body = requestBody
   return requestUtils.sendRequest({ method: 'post', options })
 }
+
 HTTPClient.prototype.scaServiceReport = function scaServiceReport(
   config,
   reportId
@@ -460,21 +461,21 @@ function createSnapshotURL(config) {
 }
 
 function createScaServiceReportURL(config, reportId) {
-  let baseUrl = `${config.host}/Contrast/api/sca/organizations/${config.organizationId}/libraries/applications/${config.applicationId}/reports/${reportId}`
+  let baseUrl = `${config.host}/Contrast/api/sca/organizations/${config.organizationId}/applications/${config.applicationId}/libraries/reports/${reportId}`
   baseUrl = config.ignoreDev ? baseUrl.concat('?nodesToInclude=PROD') : baseUrl
   return baseUrl
 }
 
 function createScaServiceReportStatusURL(config, reportId) {
-  return `${config.host}/Contrast/api/sca/organizations/${config.organizationId}/libraries/ingests/${reportId}/status`
+  return `${config.host}/Contrast/api/sca/organizations/${config.organizationId}/applications/${config.applicationId}/libraries/ingests/${reportId}/status`
 }
 
 function createScaServiceIngestsURL(config) {
-  return `${config.host}/Contrast/api/sca/organizations/${config.organizationId}/libraries/ingests`
+  return `${config.host}/Contrast/api/sca/organizations/${config.organizationId}/applications/${config.applicationId}/libraries/ingests`
 }
 
 function createScaServiceIngestURL(config) {
-  let baseUrl = `${config.host}/Contrast/api/sca/organizations/${config.organizationId}/libraries/ingests/tree`
+  let baseUrl = `${config.host}/Contrast/api/sca/organizations/${config.organizationId}/applications/${config.applicationId}/libraries/ingests/tree`
   baseUrl = config.track ? baseUrl.concat('?persist=true') : baseUrl
   return baseUrl
 }

package/src/common/errorHandling.js

@@ -1,4 +1,5 @@
 const i18n = require('i18n')
+const chalk = require('chalk')
 
 const libraryAnalysisError = () => {
   console.log(i18n.__('libraryAnalysisError'))
@@ -48,6 +49,22 @@ const maxAppError = () => {
   process.exit(1)
 }
 
+const parametersError = () => {
+  generalError(
+    `Values not recognised`,
+    'Check your command & keys again for hidden characters.\nFor more information use contrast help.'
+  )
+  process.exit(1)
+}
+
+const invalidHostNameError = () => {
+  generalError(
+    `Invalid host`,
+    'Check that the host parameter does not include a trailing "/".'
+  )
+  process.exit(1)
+}
+
 const failOptionError = () => {
   console.log(
     '\n ******************************** ' +
@@ -108,6 +125,17 @@ const findCommandOnError = unknownOptions => {
   }
 }
 
+const commonMessageFormatter = (message, fail) => {
+  console.log(chalk.bold(i18n.__(message.title)))
+  console.log(i18n.__(message.body))
+  if (message.extra) {
+    console.log(i18n.__(message.extra))
+  }
+  if (fail) {
+    process.exit(1)
+  }
+}
+
 module.exports = {
   genericError,
   unauthenticatedError,
@@ -122,5 +150,8 @@ module.exports = {
   snapshotFailureError,
   vulnerabilitiesFailureError,
   reportFailureError,
-  maxAppError
+  maxAppError,
+  parametersError,
+  invalidHostNameError,
+  commonMessageFormatter
 }

package/src/constants/constants.js

@@ -14,7 +14,7 @@ const HIGH = 'HIGH'
 const CRITICAL = 'CRITICAL'
 // App
 const APP_NAME = 'contrast'
-const APP_VERSION = '1.0.17'
+const APP_VERSION = '1.0.19'
 const TIMEOUT = 120000
 const HIGH_COLOUR = '#ff9900'
 const CRITICAL_COLOUR = '#e35858'