@contrast/contrast 1.0.18 → 1.0.20

package/src/common/errorHandling.js

@@ -1,4 +1,5 @@
 const i18n = require('i18n')
+const chalk = require('chalk')
 
 const libraryAnalysisError = () => {
   console.log(i18n.__('libraryAnalysisError'))
@@ -124,6 +125,17 @@ const findCommandOnError = unknownOptions => {
   }
 }
 
+const commonMessageFormatter = (message, fail) => {
+  console.log(chalk.bold(i18n.__(message.title)))
+  console.log(i18n.__(message.body))
+  if (message.extra) {
+    console.log(i18n.__(message.extra))
+  }
+  if (fail) {
+    process.exit(1)
+  }
+}
+
 module.exports = {
   genericError,
   unauthenticatedError,
@@ -140,5 +152,6 @@ module.exports = {
   reportFailureError,
   maxAppError,
   parametersError,
-  invalidHostNameError
+  invalidHostNameError,
+  commonMessageFormatter
 }

package/src/constants/constants.js

@@ -14,7 +14,7 @@ const HIGH = 'HIGH'
 const CRITICAL = 'CRITICAL'
 // App
 const APP_NAME = 'contrast'
-const APP_VERSION = '1.0.18'
+const APP_VERSION = '1.0.20'
 const TIMEOUT = 120000
 const HIGH_COLOUR = '#ff9900'
 const CRITICAL_COLOUR = '#e35858'

package/src/constants/locales.js

@@ -194,7 +194,10 @@ const en_locales = () => {
       chalk.bold('\ncontrast scan') +
       " to run Contrast's industry leading SAST scanner. \nSupports Java, JavaScript and .Net \n" +
       chalk.bold('\ncontrast audit') +
-      ' to find vulnerabilities in your open source dependencies.\nSupports Java, .NET, Node, Ruby, Python, Go and PHP \n' +
+      ' to find vulnerabilities in your open source dependencies.' +
+      '\nSupports Java, .NET, Node, Ruby, Python, Go and PHP.' +
+      '\nOur CLI runs native build tools to generate a complete dependency tree.' +
+      '\nIf you are running on untrusted code, consider running in a sandbox.\n' +
       chalk.bold('\ncontrast lambda') +
       ' to secure your AWS serverless functions. \nSupports Java and Python \n' +
       chalk.bold('\ncontrast help') +
@@ -259,7 +262,8 @@ const en_locales = () => {
     )} Maven build platform including the dependency plugin. 
     ${chalk.bold('Or')} build.gradle ${chalk.bold(
       'and'
-    )} gradle dependencies or ./gradlew dependencies must be supported`,
+    )} gradle dependencies or ./gradlew dependencies must be supported
+    If you are running on untrusted code, consider running in a sandbox.`,
     constantsAuditPrerequisitesContentDotNetMessage: `
     ${chalk.bold(
       '.NET framework and .NET core:'
@@ -317,6 +321,19 @@ const en_locales = () => {
       'Join the discussion:'
     ),
     commonHelpJoinDiscussionText: ' https://dev.to/codesec',
+    authCommand: {
+      credentialsAccepted: {
+        title: 'Credentials accepted',
+        body: 'Now run contrast audit, lambda or scan',
+        extra: 'Or contrast help for full list of commands'
+      },
+      credentialsMissing: {
+        title: 'Credentials missing',
+        body: 'You have not entered the right parameters or enough information',
+        extra:
+          'Please check and try again e.g. contrast auth --api-key yourApiKey--organization-id yourOrg --authorization yourAuth --host https://yourHost\nOr contrast help for full list of commands'
+      }
+    },
     ...lambda
   }
 }

package/src/scaAnalysis/common/auditReport.js

@@ -1,105 +1,50 @@
 const {
   getSeverityCounts,
-  createSummaryMessageTop,
-  printVulnInfo,
-  getReportTable,
-  getIssueRow,
   printNoVulnFoundMsg
 } = require('../../audit/report/commonReportingFunctions')
-const { orderBy } = require('lodash')
-const { assignBySeverity } = require('../../scan/formatScanOutput')
-const chalk = require('chalk')
-const { CE_URL } = require('../../constants/constants')
 const common = require('../../common/fail')
-const i18n = require('i18n')
+const { printFormattedOutputSca } = require('./commonReportingFunctionsSca')
 
-const processAuditReport = (config, results) => {
+const processAuditReport = (config, reportModelList) => {
   let severityCounts = {}
-  if (results !== undefined) {
-    severityCounts = formatScaServicesReport(config, results)
+  if (reportModelList !== undefined) {
+    severityCounts = formatScaServicesReport(config, reportModelList)
   }
 
   if (config.fail) {
     common.processFail(config, severityCounts)
   }
 }
-const formatScaServicesReport = (config, results) => {
-  const projectOverviewCount = getSeverityCounts(results)
+const formatScaServicesReport = (config, reportModelList) => {
+  const projectOverviewCount = getSeverityCounts(reportModelList)
 
   if (projectOverviewCount.total === 0) {
     printNoVulnFoundMsg()
-    return projectOverviewCount
   } else {
-    let total = 0
-    const numberOfCves = results.length
-    const table = getReportTable()
-    let contrastHeaderNumCounter = 0
-    let assignPriorityToResults = results.map(result =>
-      assignBySeverity(result, result)
-    )
-    const numberOfVulns = results
-      .map(result => result.vulnerabilities)
-      .reduce((a, b) => {
-        return (total += b.length)
-      }, 0)
-    const outputOrderedByLowestSeverityAndLowestNumOfCvesFirst = orderBy(
-      assignPriorityToResults,
-      [
-        reportListItem => {
-          return reportListItem.priority
-        },
-        reportListItem => {
-          return reportListItem.vulnerabilities.length
-        }
-      ],
-      ['asc', 'desc']
-    )
-
-    for (const result of outputOrderedByLowestSeverityAndLowestNumOfCvesFirst) {
-      contrastHeaderNumCounter++
-      const cvesNum = result.vulnerabilities.length
-      const grammaticallyCorrectVul =
-        result.vulnerabilities.length > 1 ? 'vulnerabilities' : 'vulnerability'
-
-      const headerColour = chalk.hex(result.colour)
-      const headerRow = [
-        headerColour(
-          `CONTRAST-${contrastHeaderNumCounter.toString().padStart(3, '0')}`
-        ),
-        headerColour(`-`),
-        headerColour(`[${result.severity}] `) +
-          headerColour.bold(`${result.artifactName}`) +
-          ` introduces ${cvesNum} ${grammaticallyCorrectVul}`
-      ]
+    const numberOfVulnerableLibraries = reportModelList.map(library => {
+      let count = 0
 
-      const adviceRow = [
-        chalk.bold(`Advice`),
-        chalk.bold(`:`),
-        `Change to version ${result.remediationAdvice.latestStableVersion}`
-      ]
+      if (library.vulnerabilities.length > 0) {
+        count++
+      }
 
-      let assignPriorityToVulns = result.vulnerabilities.map(result =>
-        assignBySeverity(result, result)
-      )
-      const issueRow = getIssueRow(assignPriorityToVulns)
+      return count
+    }).length
 
-      table.push(headerRow, issueRow, adviceRow)
-      console.log()
-    }
-
-    console.log()
-    createSummaryMessageTop(numberOfCves, numberOfVulns)
-    console.log(table.toString() + '\n')
-    printVulnInfo(projectOverviewCount)
+    let numberOfCves = reportModelList.reduce(
+      (count, current) => count + current.vulnerabilities.length,
+      0
+    )
 
-    if (config.host !== CE_URL) {
-      console.log('\n' + chalk.bold(i18n.__('auditServicesMessageForTS')))
-      console.log(
-        `${config.host}/Contrast/static/ng/index.html#/${config.organizationId}/applications/${config.applicationId}/libs`
-      )
-    }
-    return projectOverviewCount
+    printFormattedOutputSca(
+      config,
+      reportModelList,
+      numberOfVulnerableLibraries,
+      numberOfCves
+    )
   }
+
+  return projectOverviewCount
 }
 module.exports = {
   formatScaServicesReport,

package/src/scaAnalysis/common/commonReportingFunctionsSca.js

@@ -0,0 +1,276 @@
+const {
+  ReportList,
+  ReportModelStructure,
+  ReportCompositeKey
+} = require('../../audit/report/models/reportListModel')
+const {
+  countVulnerableLibrariesBySeverity
+} = require('../../audit/report/utils/reportUtils')
+const {
+  SeverityCountModel
+} = require('../../audit/report/models/severityCountModel')
+const { orderBy } = require('lodash')
+const {
+  ReportOutputModel,
+  ReportOutputHeaderModel,
+  ReportOutputBodyModel
+} = require('../../audit/report/models/reportOutputModel')
+const {
+  CE_URL,
+  CRITICAL_COLOUR,
+  HIGH_COLOUR,
+  MEDIUM_COLOUR,
+  LOW_COLOUR,
+  NOTE_COLOUR
+} = require('../../constants/constants')
+const chalk = require('chalk')
+const Table = require('cli-table3')
+const {
+  findHighestSeverityCVESca,
+  severityCountAllCVEsSca,
+  findCVESeveritySca,
+  orderByHighestPrioritySca
+} = require('./utils/reportUtilsSca')
+const {
+  buildFormattedHeaderNum
+} = require('../../audit/report/commonReportingFunctions')
+
+const createSummaryMessageTop = (numberOfVulnerableLibraries, numberOfCves) => {
+  numberOfVulnerableLibraries === 1
+    ? console.log(
+        `\n\nFound 1 vulnerable library containing ${numberOfCves} CVE`
+      )
+    : console.log(
+        `\n\nFound ${numberOfVulnerableLibraries} vulnerable libraries containing ${numberOfCves} CVEs`
+      )
+}
+
+const createSummaryMessageBottom = numberOfVulnerableLibraries => {
+  numberOfVulnerableLibraries === 1
+    ? console.log(`Found 1 vulnerability`)
+    : console.log(`Found ${numberOfVulnerableLibraries} vulnerabilities`)
+}
+
+const printFormattedOutputSca = (
+  config,
+  reportModelList,
+  numberOfVulnerableLibraries,
+  numberOfCves
+) => {
+  createSummaryMessageTop(numberOfVulnerableLibraries, numberOfCves)
+  console.log()
+  const report = new ReportList()
+
+  for (const library of reportModelList) {
+    const { artifactName, version, vulnerabilities, remediationAdvice } =
+      library
+
+    const newOutputModel = new ReportModelStructure(
+      new ReportCompositeKey(
+        artifactName,
+        version,
+        findHighestSeverityCVESca(vulnerabilities),
+        severityCountAllCVEsSca(
+          vulnerabilities,
+          new SeverityCountModel()
+        ).getTotal
+      ),
+      vulnerabilities,
+      remediationAdvice
+    )
+    report.reportOutputList.push(newOutputModel)
+  }
+
+  const outputOrderedByLowestSeverityAndLowestNumOfCvesFirst = orderBy(
+    report.reportOutputList,
+    [
+      reportListItem => {
+        return reportListItem.compositeKey.highestSeverity.priority
+      },
+      reportListItem => {
+        return reportListItem.compositeKey.numberOfSeverities
+      }
+    ],
+    ['asc', 'desc']
+  )
+
+  let contrastHeaderNumCounter = 0
+  for (const reportModel of outputOrderedByLowestSeverityAndLowestNumOfCvesFirst) {
+    contrastHeaderNumCounter++
+    const { libraryName, libraryVersion, highestSeverity } =
+      reportModel.compositeKey
+
+    const { cveArray, remediationAdvice } = reportModel
+
+    const numOfCVEs = reportModel.cveArray.length
+
+    const table = getReportTable()
+
+    const header = buildHeader(
+      highestSeverity,
+      contrastHeaderNumCounter,
+      libraryName,
+      libraryVersion,
+      numOfCVEs
+    )
+
+    const body = buildBody(cveArray, remediationAdvice)
+
+    const reportOutputModel = new ReportOutputModel(header, body)
+
+    table.push(
+      reportOutputModel.body.issueMessage,
+      reportOutputModel.body.adviceMessage
+    )
+
+    console.log(
+      reportOutputModel.header.vulnMessage,
+      reportOutputModel.header.introducesMessage
+    )
+    console.log(table.toString() + '\n')
+  }
+
+  createSummaryMessageBottom(numberOfVulnerableLibraries)
+  const {
+    criticalMessage,
+    highMessage,
+    mediumMessage,
+    lowMessage,
+    noteMessage
+  } = buildFooter(outputOrderedByLowestSeverityAndLowestNumOfCvesFirst)
+  console.log(
+    `${criticalMessage} | ${highMessage} | ${mediumMessage} | ${lowMessage} | ${noteMessage}`
+  )
+
+  if (config.host !== CE_URL) {
+    console.log(
+      '\n' + chalk.bold('View your full dependency tree in Contrast:')
+    )
+    console.log(
+      `${config.host}/Contrast/static/ng/index.html#/${config.organizationId}/applications/${config.applicationId}/libs/dependency-tree`
+    )
+  }
+}
+
+function getReportTable() {
+  return new Table({
+    chars: {
+      top: '',
+      'top-mid': '',
+      'top-left': '',
+      'top-right': '',
+      bottom: '',
+      'bottom-mid': '',
+      'bottom-left': '',
+      'bottom-right': '',
+      left: '',
+      'left-mid': '',
+      mid: '',
+      'mid-mid': '',
+      right: '',
+      'right-mid': '',
+      middle: ' '
+    },
+    style: { 'padding-left': 0, 'padding-right': 0 },
+    colAligns: ['right'],
+    wordWrap: true,
+    colWidths: [12, 1, 100]
+  })
+}
+
+function buildHeader(
+  highestSeverity,
+  contrastHeaderNum,
+  libraryName,
+  version,
+  numOfCVEs
+) {
+  const vulnerabilityPluralised =
+    numOfCVEs > 1 ? 'vulnerabilities' : 'vulnerability'
+  const formattedHeaderNum = buildFormattedHeaderNum(contrastHeaderNum)
+
+  const headerColour = chalk.hex(highestSeverity.colour)
+  const headerNumAndSeverity = headerColour(
+    `${formattedHeaderNum} - [${highestSeverity.severity}]`
+  )
+  const libraryNameAndVersion = headerColour.bold(`${libraryName}-${version}`)
+  const vulnMessage = `${headerNumAndSeverity} ${libraryNameAndVersion}`
+
+  const introducesMessage = `introduces ${numOfCVEs} ${vulnerabilityPluralised}`
+
+  return new ReportOutputHeaderModel(vulnMessage, introducesMessage)
+}
+
+function buildBody(cveArray, advice) {
+  const orderedCvesWithSeverityAssigned = orderByHighestPrioritySca(
+    cveArray.map(cve => findCVESeveritySca(cve))
+  )
+  const issueMessage = getIssueRow(orderedCvesWithSeverityAssigned)
+  const adviceMessage = getAdviceRow(advice)
+
+  return new ReportOutputBodyModel(issueMessage, adviceMessage)
+}
+
+function getIssueRow(cveArray) {
+  const cveMessagesList = getIssueCveMsgList(cveArray)
+  return [chalk.bold('Issue'), ':', `${cveMessagesList.join(', ')}`]
+}
+
+function getAdviceRow(advice) {
+  const latestOrClosest = advice.latestStableVersion
+    ? advice.latestStableVersion
+    : advice.closestStableVersion
+  const displayAdvice = latestOrClosest
+    ? `Change to version ${chalk.bold(latestOrClosest)}`
+    : 'No recommendation is available according to our data. Upgrade to the latest stable is the best advice we can give.'
+
+  return [chalk.bold(`Advice`), chalk.bold(`:`), `${displayAdvice}`]
+}
+
+const buildFooter = reportModelStructure => {
+  const { critical, high, medium, low, note } =
+    countVulnerableLibrariesBySeverity(reportModelStructure)
+
+  const criticalMessage = chalk
+    .hex(CRITICAL_COLOUR)
+    .bold(`${critical} Critical`)
+  const highMessage = chalk.hex(HIGH_COLOUR).bold(`${high} High`)
+  const mediumMessage = chalk.hex(MEDIUM_COLOUR).bold(`${medium} Medium`)
+  const lowMessage = chalk.hex(LOW_COLOUR).bold(`${low} Low`)
+  const noteMessage = chalk.hex(NOTE_COLOUR).bold(`${note} Note`)
+
+  return {
+    criticalMessage,
+    highMessage,
+    mediumMessage,
+    lowMessage,
+    noteMessage
+  }
+}
+
+const getIssueCveMsgList = reportSeverityModels => {
+  const cveMessages = []
+  reportSeverityModels.forEach(reportSeverityModel => {
+    const { colour, severity, name } = reportSeverityModel
+
+    const severityShorthand = chalk
+      .hex(colour)
+      .bold(`[${severity.charAt(0).toUpperCase()}]`)
+
+    const builtMessage = severityShorthand + name
+    cveMessages.push(builtMessage)
+  })
+  return cveMessages
+}
+
+module.exports = {
+  createSummaryMessageTop,
+  createSummaryMessageBottom,
+  printFormattedOutputSca,
+  getReportTable,
+  buildHeader,
+  buildBody,
+  getIssueRow,
+  buildFormattedHeaderNum,
+  getIssueCveMsgList
+}

package/src/scaAnalysis/common/models/ScaReportModel.ts

@@ -0,0 +1,81 @@
+export class ScaReportModel {
+  uuid: string
+  groupName: string
+  artifactName: string
+  version: string
+  hash: string
+  fileName: string
+  libraryLanguage: string
+  vulnerable: boolean
+  privateLibrary: boolean
+  severity: string
+  releaseDate: string
+  latestVersionReleaseDate: string
+  latestVersion: string
+  versionsBehind: number
+  vulnerabilities: ScaReportVulnerabilityModel[]
+  remediationAdvice: ScaReportRemediationAdviceModel
+
+  constructor(library: any) {
+    this.uuid = library.uuid
+    this.groupName = library.groupName
+    this.artifactName = library.artifactName
+    this.version = library.version
+    this.hash = library.hash
+    this.fileName = library.fileName
+    this.libraryLanguage = library.libraryLanguage
+    this.vulnerable = library.vulnerable
+    this.privateLibrary = library.privateLibrary
+    this.severity = library.severity
+    this.releaseDate = library.releaseDate
+    this.latestVersionReleaseDate = library.latestVersionReleaseDate
+    this.latestVersion = library.latestVersion
+    this.versionsBehind = library.versionsBehind
+    this.vulnerabilities = library.vulnerabilities
+    this.remediationAdvice = library.remediationAdvice
+  }
+}
+
+export class ScaReportVulnerabilityModel {
+  name: string
+  description: string
+  cvss2Vector: string
+  severityValue: number
+  severity: string
+  cvss3Vector: string
+  cvss3SeverityValue: number
+  cvss3Severity: string
+  hasCvss3: boolean
+
+  constructor(
+    name: string,
+    description: string,
+    cvss2Vector: string,
+    severityValue: number,
+    severity: string,
+    cvss3Vector: string,
+    cvss3SeverityValue: number,
+    cvss3Severity: string,
+    hasCvss3: boolean
+  ) {
+    this.name = name
+    this.description = description
+    this.cvss2Vector = cvss2Vector
+    this.severityValue = severityValue
+    this.severity = severity
+    this.cvss3Vector = cvss3Vector
+    this.cvss3SeverityValue = cvss3SeverityValue
+    this.cvss3Severity = cvss3Severity
+    this.hasCvss3 = hasCvss3
+  }
+}
+
+export class ScaReportRemediationAdviceModel {
+  closestStableVersion: string
+  latestStableVersion: string
+
+  constructor(closestStableVersion: string, latestStableVersion: string) {
+    this.closestStableVersion = closestStableVersion
+    this.latestStableVersion = latestStableVersion
+  }
+}

package/src/scaAnalysis/common/scaServicesUpload.js

@@ -46,17 +46,19 @@ const scaTreeUpload = async (analysis, config) => {
       if (res.body.status === 'COMPLETED') {
         keepChecking = false
         return client.scaServiceReport(config, reportID).then(res => {
-          return [res.body, reportID]
+          const reportBody = res.body
+          return { reportBody, reportID }
         })
       }
     })
 
     if (!keepChecking) {
-      return [res, reportID]
+      return { reportArray: res.reportBody, reportID }
     }
     await requestUtils.sleep(5000)
   }
-  return [res, reportID]
+
+  return { reportArray: res, reportID }
 }
 
 module.exports = {