@contrast/contrast 1.0.18 → 1.0.20

package/src/scaAnalysis/common/utils/reportUtilsSca.ts

@@ -0,0 +1,123 @@
+import { orderBy } from 'lodash'
+import {
+  CRITICAL_COLOUR,
+  CRITICAL_PRIORITY,
+  HIGH_COLOUR,
+  HIGH_PRIORITY,
+  LOW_COLOUR,
+  LOW_PRIORITY,
+  MEDIUM_COLOUR,
+  MEDIUM_PRIORITY,
+  NOTE_COLOUR,
+  NOTE_PRIORITY
+} from '../../../constants/constants'
+import { ReportSeverityModel } from '../../../audit/report/models/reportSeverityModel'
+import { SeverityCountModel } from '../../../audit/report/models/severityCountModel'
+import {
+  ScaReportModel,
+  ScaReportVulnerabilityModel
+} from '../models/ScaReportModel'
+
+export function findHighestSeverityCVESca(
+  cveArray: ScaReportVulnerabilityModel[]
+) {
+  const mappedToReportSeverityModels = cveArray.map(cve =>
+    findCVESeveritySca(cve)
+  )
+
+  //order and get first
+  return orderBy(mappedToReportSeverityModels, cve => cve?.priority)[0]
+}
+
+export function orderByHighestPrioritySca(
+  reportSeverityModel: ReportSeverityModel[]
+) {
+  return orderBy(reportSeverityModel, ['priority'], ['asc'])
+}
+
+export function findCVESeveritySca(
+  vulnerabilityModel: ScaReportVulnerabilityModel
+) {
+  const { name } = vulnerabilityModel
+
+  if (
+    vulnerabilityModel.cvss3Severity === 'CRITICAL' ||
+    vulnerabilityModel.severity === 'CRITICAL'
+  ) {
+    return new ReportSeverityModel(
+      'CRITICAL',
+      CRITICAL_PRIORITY,
+      CRITICAL_COLOUR,
+      name
+    )
+  } else if (
+    vulnerabilityModel.cvss3Severity === 'HIGH' ||
+    vulnerabilityModel.severity === 'HIGH'
+  ) {
+    return new ReportSeverityModel('HIGH', HIGH_PRIORITY, HIGH_COLOUR, name)
+  } else if (
+    vulnerabilityModel.cvss3Severity === 'MEDIUM' ||
+    vulnerabilityModel.severity === 'MEDIUM'
+  ) {
+    return new ReportSeverityModel(
+      'MEDIUM',
+      MEDIUM_PRIORITY,
+      MEDIUM_COLOUR,
+      name
+    )
+  } else if (
+    vulnerabilityModel.cvss3Severity === 'LOW' ||
+    vulnerabilityModel.severity === 'LOW'
+  ) {
+    return new ReportSeverityModel('LOW', LOW_PRIORITY, LOW_COLOUR, name)
+  } else if (
+    vulnerabilityModel.cvss3Severity === 'NOTE' ||
+    vulnerabilityModel.severity === 'NOTE'
+  ) {
+    return new ReportSeverityModel('NOTE', NOTE_PRIORITY, NOTE_COLOUR, name)
+  }
+}
+
+export function convertGenericToTypedReportModelSca(reportArray: any) {
+  return reportArray.map((library: any) => {
+    return new ScaReportModel(library)
+  })
+}
+
+export function severityCountAllLibrariesSca(
+  vulnerableLibraries: ScaReportModel[],
+  severityCount: SeverityCountModel
+) {
+  vulnerableLibraries.forEach(lib =>
+    severityCountAllCVEsSca(lib.vulnerabilities, severityCount)
+  )
+  return severityCount
+}
+
+export function severityCountAllCVEsSca(
+  cveArray: ScaReportVulnerabilityModel[],
+  severityCount: SeverityCountModel
+) {
+  const severityCountInner = severityCount
+  cveArray.forEach(cve => severityCountSingleCVESca(cve, severityCountInner))
+  return severityCountInner
+}
+
+export function severityCountSingleCVESca(
+  cve: ScaReportVulnerabilityModel,
+  severityCount: SeverityCountModel
+) {
+  if (cve.cvss3Severity === 'CRITICAL' || cve.severity === 'CRITICAL') {
+    severityCount.critical += 1
+  } else if (cve.cvss3Severity === 'HIGH' || cve.severity === 'HIGH') {
+    severityCount.high += 1
+  } else if (cve.cvss3Severity === 'MEDIUM' || cve.severity === 'MEDIUM') {
+    severityCount.medium += 1
+  } else if (cve.cvss3Severity === 'LOW' || cve.severity === 'LOW') {
+    severityCount.low += 1
+  } else if (cve.cvss3Severity === 'NOTE' || cve.severity === 'NOTE') {
+    severityCount.note += 1
+  }
+
+  return severityCount
+}

package/src/scaAnalysis/java/analysis.js

@@ -147,34 +147,7 @@ const getJavaBuildDeps = (config, files) => {
   }
 }
 
-const agreementPrompt = async config => {
-  const rl = readLine.createInterface({
-    input: process.stdin,
-    output: process.stdout
-  })
-
-  return new Promise((resolve, reject) => {
-    rl.question('❔ Do you want to continue? Type Y or N', async input => {
-      if (input.toLowerCase() === 'yes' || input.toLowerCase() === 'y') {
-        config.javaAgreement = paramHandler.setAgreement(true)
-        rl.close()
-        resolve(config)
-      } else if (input.toLowerCase() === 'no' || input.toLowerCase() === 'n') {
-        rl.close()
-        resolve(process.exit(1))
-      } else {
-        rl.close()
-        console.log('Invalid Input: Exiting')
-        resolve(process.exit(1))
-      }
-    })
-  }).catch(e => {
-    throw e
-  })
-}
-
 module.exports = {
   getJavaBuildDeps,
-  determineProjectTypeAndCwd,
-  agreementPrompt
+  determineProjectTypeAndCwd
 }

package/src/scaAnalysis/java/index.js

@@ -4,16 +4,12 @@ const { createJavaTSMessage } = require('../common/formatMessage')
 const {
   parseDependenciesForSCAServices
 } = require('../common/scaParserForGoAndJava')
-const chalk = require('chalk')
-const _ = require('lodash')
 
 const javaAnalysis = async (config, languageFiles) => {
   languageFiles.JAVA.forEach(file => {
     file.replace('build.gradle.kts', 'build.gradle')
   })
 
-  await getAgreement(config)
-
   const javaDeps = buildJavaTree(config, languageFiles.JAVA)
 
   if (config.experimental) {
@@ -23,24 +19,11 @@ const javaAnalysis = async (config, languageFiles) => {
   }
 }
 
-const getAgreement = async config => {
-  console.log(chalk.bold('Java project detected'))
-  console.log(
-    'Java analysis uses maven / gradle which are potentially susceptible to command injection. Be sure that the code you are running Contrast CLI on is trusted before continuing.'
-  )
-
-  if (!process.env.CI && !config?.javaAgreement) {
-    return await analysis.agreementPrompt(config)
-  }
-  return config
-}
-
 const buildJavaTree = (config, files) => {
   const javaBuildDeps = analysis.getJavaBuildDeps(config, files)
   return parseBuildDeps(config, javaBuildDeps)
 }
 
 module.exports = {
-  javaAnalysis,
-  getAgreement
+  javaAnalysis
 }

package/src/scan/formatScanOutput.ts

@@ -1,7 +1,4 @@
-import {
-  ScanResultsInstances,
-  ScanResultsModel
-} from './models/scanResultsModel'
+import { ScanResultsModel } from './models/scanResultsModel'
 import i18n from 'i18n'
 import chalk from 'chalk'
 import { ResultContent } from './models/resultContentModel'
@@ -13,7 +10,8 @@ import {
   HIGH_COLOUR,
   LOW_COLOUR,
   MEDIUM_COLOUR,
-  NOTE_COLOUR
+  NOTE_COLOUR,
+  supportedLanguagesScan
 } from '../constants/constants'
 import {
   getSeverityCounts,
@@ -21,27 +19,28 @@ import {
 } from '../audit/report/commonReportingFunctions'
 
 export function formatScanOutput(scanResults: ScanResultsModel) {
-  const { scanResultsInstances } = scanResults
+  const { content } = scanResults.scanResultsInstances
+  const { language } = scanResults.scanDetail
 
-  const projectOverview = getSeverityCounts(scanResultsInstances.content)
-  if (scanResultsInstances.content.length === 0) {
+  const severityCounts = getSeverityCounts(content)
+  if (content.length === 0) {
     console.log(i18n.__('scanNoVulnerabilitiesFound'))
     console.log(i18n.__('scanNoVulnerabilitiesFoundSecureCode'))
     console.log(i18n.__('scanNoVulnerabilitiesFoundGoodWork'))
   } else {
     const message =
-      projectOverview.critical || projectOverview.high
+      severityCounts.critical || severityCounts.high
         ? 'Here are your top priorities to fix'
         : "No major issues, here's what we found"
     console.log(chalk.bold(message))
     console.log()
 
-    let defaultView = getDefaultView(scanResultsInstances.content)
+    const defaultView = getDefaultView(content, language)
 
     let count = 0
     defaultView.forEach(entry => {
       count++
-      let table = new Table({
+      const table = new Table({
         chars: {
           top: '',
           'top-mid': '',
@@ -64,6 +63,7 @@ export function formatScanOutput(scanResults: ScanResultsModel) {
         wordWrap: true,
         colWidths: [12, 1, 100]
       })
+
       let learnRow: string[] = []
       let adviceRow = []
       const headerColour = chalk.hex(entry.colour)
@@ -107,9 +107,9 @@ export function formatScanOutput(scanResults: ScanResultsModel) {
       console.log()
     })
   }
-  printVulnInfo(projectOverview)
+  printVulnInfo(severityCounts)
 
-  return projectOverview
+  return severityCounts
 }
 
 export function formatLinks(objName: string, entry: any[]) {
@@ -124,7 +124,7 @@ export function formatLinks(objName: string, entry: any[]) {
   }
 }
 
-export function getDefaultView(content: ResultContent[]) {
+export function getDefaultView(content: ResultContent[], language: string) {
   const groupTypeResults = [] as GroupedResultsModel[]
 
   content.forEach(resultEntry => {
@@ -136,8 +136,7 @@ export function getDefaultView(content: ResultContent[]) {
     groupResultsObj.learn = resultEntry.learn
     groupResultsObj.message = resultEntry.message?.text
       ? editVulName(resultEntry.message.text) +
-        ':' +
-        getSourceLineNumber(resultEntry)
+        doAddSourceLineNumber(resultEntry, language)
       : ''
     groupResultsObj.codePath = getLocationsSyncInfo(resultEntry)
     groupTypeResults.push(groupResultsObj)
@@ -146,9 +145,21 @@ export function getDefaultView(content: ResultContent[]) {
 
   return sortBy(groupTypeResults, ['priority'])
 }
+
+export function doAddSourceLineNumber(
+  resultEntry: ResultContent,
+  language: string
+) {
+  //only add source line num if not JS
+  return language !== supportedLanguagesScan.JAVASCRIPT
+    ? ':' + getSourceLineNumber(resultEntry)
+    : ''
+}
+
 export function editVulName(message: string) {
   return message.substring(message.indexOf(' in '))
 }
+
 export function getLocationsSyncInfo(resultEntry: ResultContent) {
   const locationsMessage =
     resultEntry.locations[0]?.physicalLocation?.artifactLocation?.uri || ''
@@ -165,7 +176,7 @@ export function getLocationsSyncInfo(resultEntry: ResultContent) {
 export function getSourceLineNumber(resultEntry: ResultContent) {
   const locationsLineNumber =
     resultEntry.locations[0]?.physicalLocation?.region?.startLine || ''
-  let codeFlowLineNumber = getCodeFlowInfo(resultEntry)
+  const codeFlowLineNumber = getCodeFlowInfo(resultEntry)
 
   return codeFlowLineNumber ? codeFlowLineNumber : locationsLineNumber
 }

package/src/utils/getConfig.ts

@@ -8,7 +8,6 @@ type ContrastConfOptions = Partial<{
   orgId: string
   authHeader: string
   numOfRuns: number
-  javaAgreement: boolean
 }>
 
 type ContrastConf = Conf<ContrastConfOptions>
@@ -29,7 +28,7 @@ const setConfigValues = (config: ContrastConf, values: ContrastConfOptions) => {
   config.set('apiKey', values.apiKey)
   config.set('organizationId', values.orgId)
   config.set('authorization', values.authHeader)
-  values.host ? config.set('host', values.host) : null
+  values.host ? config.set('host', values.host) : config.set('host', CE_URL)
 }
 
 export { localConfig, setConfigValues, ContrastConf, ContrastConfOptions }

package/src/utils/paramsUtil/configStoreParams.js

@@ -16,17 +16,4 @@ const getAuth = () => {
   return ContrastConfToUse
 }
 
-const getAgreement = () => {
-  const ContrastConf = config.localConfig(APP_NAME, APP_VERSION)
-  let ContrastConfToUse = {}
-  ContrastConfToUse.javaAgreement = ContrastConf.get('javaAgreement')
-  return ContrastConfToUse
-}
-
-const setAgreement = agreement => {
-  const ContrastConf = config.localConfig(APP_NAME, APP_VERSION)
-  ContrastConf.set('javaAgreement', agreement)
-  return agreement
-}
-
-module.exports = { getAuth, getAgreement, setAgreement }
+module.exports = { getAuth }

package/src/utils/paramsUtil/paramHandler.js

@@ -21,12 +21,4 @@ const getAuth = params => {
   }
 }
 
-const getAgreement = () => {
-  return configStoreParams.getAgreement()
-}
-
-const setAgreement = answer => {
-  return configStoreParams.setAgreement(answer)
-}
-
-module.exports = { getAuth, getAgreement, setAgreement }
+module.exports = { getAuth }