@contrast/contrast 1.0.2 → 1.0.5

package/src/scan/formatScanOutput.ts

@@ -0,0 +1,241 @@
+import { ProjectOverview, ScanResultsModel } from './models/scanResultsModel'
+import i18n from 'i18n'
+import chalk from 'chalk'
+import { ResultContent } from './models/resultContentModel'
+import { GroupedResultsModel } from './models/groupedResultsModel'
+import { sortBy } from 'lodash'
+import Table from 'cli-table3'
+import {
+  CRITICAL_COLOUR,
+  HIGH_COLOUR,
+  LOW_COLOUR,
+  MEDIUM_COLOUR,
+  NOTE_COLOUR
+} from '../constants/constants'
+
+export function formatScanOutput(scanResults: ScanResultsModel) {
+  const { scanResultsInstances } = scanResults
+
+  let projectOverview = getProjectOverview(scanResultsInstances.content)
+  if (scanResultsInstances.content.length === 0) {
+    console.log(i18n.__('scanNoVulnerabilitiesFound'))
+    console.log(i18n.__('scanNoVulnerabilitiesFoundSecureCode'))
+    console.log(i18n.__('scanNoVulnerabilitiesFoundGoodWork'))
+  } else {
+    const message =
+      projectOverview.critical || projectOverview.high
+        ? 'Here are your top priorities to fix'
+        : "No major issues, here's what we found"
+    console.log(chalk.bold(message))
+    console.log()
+
+    let defaultView = getDefaultView(scanResultsInstances.content)
+
+    let count = defaultView.length
+    defaultView.forEach(entry => {
+      let table = new Table({
+        chars: {
+          top: '',
+          'top-mid': '',
+          'top-left': '',
+          'top-right': '',
+          bottom: '',
+          'bottom-mid': '',
+          'bottom-left': '',
+          'bottom-right': '',
+          left: '',
+          'left-mid': '',
+          mid: '',
+          'mid-mid': '',
+          right: '',
+          'right-mid': '',
+          middle: ' '
+        },
+        style: { 'padding-left': 0, 'padding-right': 0 },
+        colAligns: ['right'],
+        wordWrap: true,
+        colWidths: [12, 1, 100]
+      })
+      let learnRow: string[] = []
+      let adviceRow = []
+      let headerRow = [
+        chalk
+          .hex(entry.colour)
+          .bold(`CONTRAST-${count.toString().padStart(3, '0')}`),
+        chalk.hex(entry.colour).bold('-'),
+        chalk.hex(entry.colour).bold(`[${entry.severity}] ${entry.ruleId}`) +
+          entry.message
+      ]
+      let codeRow = [
+        chalk.hex('#F6F5F5').bold(`Code`),
+        chalk.hex('#F6F5F5').bold(`:`),
+        chalk.hex('#F6F5F5').bold(`${entry.codePath}`)
+      ]
+      let issueRow = [chalk.bold(`Issue`), chalk.bold(`:`), `${entry.issue}`]
+
+      table.push(headerRow, codeRow, issueRow)
+
+      if (entry?.advice) {
+        adviceRow = [
+          chalk.bold('Advice'),
+          chalk.bold(`:`),
+          stripTags(entry.advice)
+        ]
+        table.push(adviceRow)
+      }
+
+      if (entry?.learn && entry?.learn.length > 0) {
+        learnRow = [
+          chalk.bold('Learn'),
+          chalk.bold(`:`),
+          chalk.hex('#97f7f7').bold.underline(entry.learn[0])
+        ]
+        table.push(learnRow)
+      }
+      count--
+      console.log(table.toString())
+      console.log()
+    })
+  }
+  printVulnInfo(projectOverview)
+}
+
+function printVulnInfo(projectOverview: any) {
+  const totalVulnerabilities = projectOverview.total
+
+  const vulMessage =
+    totalVulnerabilities === 1 ? `vulnerability` : `vulnerabilities`
+  console.log(chalk.bold(`Found ${totalVulnerabilities} ${vulMessage}`))
+  console.log(
+    i18n.__(
+      'foundDetailedVulnerabilities',
+      String(projectOverview.critical),
+      String(projectOverview.high),
+      String(projectOverview.medium),
+      String(projectOverview.low),
+      String(projectOverview.note)
+    )
+  )
+}
+
+export function getProjectOverview(content: ResultContent[]) {
+  let acc: any = {
+    critical: 0,
+    high: 0,
+    medium: 0,
+    low: 0,
+    note: 0,
+    total: 0
+  }
+  content.forEach((i: ResultContent) => {
+    acc[i.severity.toLowerCase()] += 1
+    acc.total += 1
+    return acc
+  })
+
+  return acc
+}
+
+export function formatLinks(objName: string, entry: any[]) {
+  let line = chalk.bold(objName + '  : ')
+  if (entry.length === 1) {
+    console.log(line + chalk.hex('#97DCF7').bold.underline(entry[0]))
+  } else {
+    console.log(line)
+    entry.forEach(link => {
+      console.log(chalk.hex('#97DCF7').bold.underline(link))
+    })
+  }
+}
+
+export function getDefaultView(content: ResultContent[]) {
+  const groupTypeResults = [] as GroupedResultsModel[]
+
+  content.forEach(resultEntry => {
+    const groupResultsObj = new GroupedResultsModel(resultEntry.ruleId)
+    groupResultsObj.severity = resultEntry.severity
+    groupResultsObj.ruleId = resultEntry.ruleId
+    groupResultsObj.issue = stripTags(resultEntry.issue)
+    groupResultsObj.advice = resultEntry.advice
+    groupResultsObj.learn = resultEntry.learn
+    groupResultsObj.message = resultEntry.message?.text
+      ? editVulName(resultEntry.message.text) +
+        ':' +
+        getSourceLineNumber(resultEntry)
+      : ''
+    groupResultsObj.codePath = getLocationsSyncInfo(resultEntry)
+    groupTypeResults.push(groupResultsObj)
+    assignBySeverity(resultEntry, groupResultsObj)
+  })
+
+  return sortBy(groupTypeResults, ['priority']).reverse()
+}
+export function editVulName(message: string) {
+  return message.substring(message.indexOf(' in '))
+}
+export function getLocationsSyncInfo(resultEntry: ResultContent) {
+  const locationsMessage =
+    resultEntry.locations[0]?.physicalLocation?.artifactLocation?.uri || ''
+  const locationsLineNumber =
+    resultEntry.locations[0]?.physicalLocation?.region?.startLine || ''
+
+  if (!locationsLineNumber) {
+    return '@' + locationsMessage
+  }
+
+  return '@' + locationsMessage + ':' + locationsLineNumber
+}
+
+export function getSourceLineNumber(resultEntry: ResultContent) {
+  const locationsLineNumber =
+    resultEntry.locations[0]?.physicalLocation?.region?.startLine || ''
+  let codeFlowLineNumber = getCodeFlowInfo(resultEntry)
+
+  return codeFlowLineNumber ? codeFlowLineNumber : locationsLineNumber
+}
+
+export function getCodeFlowInfo(resultEntry: ResultContent) {
+  let result: any
+  resultEntry.codeFlows[0]?.threadFlows.forEach((i: { locations: any[] }) => {
+    return (result = i.locations.find(
+      (locations: { importance: string }) =>
+        locations.importance === 'essential'
+    ))
+  })
+
+  return result?.location?.physicalLocation?.region?.startLine
+}
+
+export function stripTags(oldString: string) {
+  return oldString
+    .replace(/\n/g, ' ')
+    .replace(/\s+/g, ' ')
+    .trim()
+}
+
+export function assignBySeverity(
+  entry: ResultContent,
+  assignedObj: GroupedResultsModel
+) {
+  if (entry.severity.toUpperCase() === 'CRITICAL') {
+    assignedObj.priority = 1
+    assignedObj.colour = CRITICAL_COLOUR
+    return assignedObj
+  } else if (entry.severity.toUpperCase() === 'HIGH') {
+    assignedObj.priority = 2
+    assignedObj.colour = HIGH_COLOUR
+    return assignedObj
+  } else if (entry.severity.toUpperCase() === 'MEDIUM') {
+    assignedObj.priority = 3
+    assignedObj.colour = MEDIUM_COLOUR
+    return assignedObj
+  } else if (entry.severity.toUpperCase() === 'LOW') {
+    assignedObj.priority = 4
+    assignedObj.colour = LOW_COLOUR
+    return assignedObj
+  } else if (entry.severity.toUpperCase() === 'NOTE') {
+    assignedObj.priority = 5
+    assignedObj.colour = NOTE_COLOUR
+    return assignedObj
+  }
+}

package/src/scan/help.js

@@ -21,14 +21,18 @@ const scanUsageGuide = commandLineUsage([
     optionList: constants.commandLineDefinitions.scanOptionDefinitions,
     hide: [
       'project-id',
-      'language',
       'organization-id',
       'api-key',
       'authorization',
       'host',
       'proxy',
+      'help',
       'ff',
-      'ignore-cert-errors'
+      'ignore-cert-errors',
+      'verbose',
+      'debug',
+      'experimental',
+      'application-name'
     ]
   },
   {

package/src/scan/models/groupedResultsModel.ts

@@ -0,0 +1,20 @@
+export class GroupedResultsModel {
+  ruleId: string
+  codePathSet: Set<string>
+  cwe?: string[]
+  reference?: string[]
+  severity?: string
+  advice?: string
+  learn?: string[]
+  issue?: string
+  priority?: number
+  message?: string | undefined
+  colour: string;
+  codePath?: string;
+
+  constructor(ruleId: string) {
+    this.ruleId = ruleId
+    this.colour = '#999999'
+    this.codePathSet = new Set<string>
+  }
+}

package/src/scan/models/resultContentModel.ts

@@ -0,0 +1,86 @@
+type Importance = 'important' | 'essential'
+
+interface ArtifactLocation {
+  uri: string
+}
+
+interface Region {
+  startLine: string
+  snippet: Snippet
+}
+
+interface Snippet {
+  text: string
+  rendered: Rendered
+}
+
+interface Rendered {
+  text: string
+}
+
+interface PhysicalLocation {
+  artifactLocation: ArtifactLocation
+  region: Region
+}
+
+interface LogicalLocation {
+  fullyQualifiedName: string
+  name: string
+}
+
+export interface Location {
+  physicalLocation: PhysicalLocation
+  logicalLocations?: LogicalLocation[]
+}
+
+export interface ThreadFlowLocation {
+  importance: Importance
+  location: Location
+}
+
+interface ThreadFlow {
+  locations: ThreadFlowLocation[]
+}
+
+interface Message {
+  text: string
+}
+
+export interface CodeFlow {
+  message: Message
+  threadFlows: ThreadFlow[]
+}
+
+export interface ResultContent {
+  message?: {text :string};
+  id: string
+  organizationId: string
+  projectId: string
+  firstCreatedTime: string
+  ruleId: string
+  codeFlows: CodeFlow[]
+  lastSeenTime: string
+  locations: Location[]
+  name: string
+  description: string
+  recommendation: string | null
+  risk: string | null
+  category: string
+  confidence: string
+  standards: { [key: string]: string[] }
+  cwe: string[]
+  owasp: string[]
+  reference: string[]
+  sink: string
+  detailsTrigger: string
+  type: RuleType
+  source: string
+  severity: Severity
+  advice: string
+  learn: string[]
+  issue: string
+}
+
+export type Severity = 'critical' | 'high' | 'medium' | 'low' | 'note'
+
+export type RuleType = 'DATA_FLOW' | 'CRYPTO' | 'CONFIG' | 'DEFAULT'

package/src/scan/models/scanResultsModel.ts

@@ -0,0 +1,52 @@
+import { ResultContent } from './resultContentModel'
+
+export class ScanResultsModel {
+  projectOverview: ProjectOverview
+  scanDetail: ScanDetail
+  scanResultsInstances: ScanResultsInstances
+
+  constructor(scan: any) {
+    this.projectOverview = scan.projectOverview as ProjectOverview
+    this.scanDetail = scan.scanDetail as ScanDetail
+    this.scanResultsInstances = scan.scanResultsInstances as ScanResultsInstances
+  }
+}
+
+export interface ProjectOverview {
+  id: string
+  organizationId: string
+  name: string
+  archived: boolean
+  language: string
+  critical: number
+  high: number
+  medium: number
+  low: number
+  note: number
+  lastScanTime: string
+  completedScans: number
+  lastScanId: string
+}
+
+export interface ScanDetail {
+  critical: number
+  high: number
+  medium: number
+  low: number
+  note: number
+  id: string
+  organizationId: string
+  projectId: string
+  codeArtifactId: string
+  status: string
+  createdTime: string
+  startedTime: string
+  completedTime: string
+  language: string
+  label: string
+  errorMessage: string
+}
+
+export interface ScanResultsInstances {
+  content: ResultContent[]
+}

package/src/scan/populateProjectIdAndProjectName.js

@@ -23,6 +23,7 @@ const createProjectId = async (config, client) => {
       }
       if (res.statusCode === 403) {
         console.log(i18n.__('permissionsError'))
+        process.exit(1)
         return
       }
 

package/src/scan/saveResults.js

@@ -1,15 +1,14 @@
 const fs = require('fs')
 
-const writeResultsToFile = (responseBody, name = 'results.sarif') => {
-  fs.writeFile(name, JSON.stringify(responseBody, null, 2), err => {
-    if (err) {
-      console.log('Error writing Scan Results to file')
-    } else {
-      console.log(`Scan Results saved to ${name}`)
-    }
-  })
+const writeResultsToFile = async (responseBody, name = 'results.sarif') => {
+  try {
+    fs.writeFileSync(name, JSON.stringify(responseBody, null, 2))
+    console.log(`Scan Results saved to ${name}`)
+  } catch (err) {
+    console.log('Error writing Scan Results to file')
+  }
 }
 
 module.exports = {
-  writeResultsToFile
+  writeResultsToFile: writeResultsToFile
 }

package/src/scan/scan.ts

@@ -0,0 +1,62 @@
+import commonApi from '../utils/commonApi.js'
+import fileUtils from '../scan/fileUtils'
+import i18n from 'i18n'
+import oraWrapper from '../utils/oraWrapper'
+
+export const allowedFileTypes = ['.jar', '.war', '.js', '.zip', '.exe']
+
+export const isFileAllowed = (scanOption: string) => {
+  let valid = false
+  allowedFileTypes.forEach(fileType => {
+    if (scanOption.endsWith(fileType)) {
+      valid = true
+    }
+  })
+  return valid
+}
+
+export const sendScan = async (config: any) => {
+  if (!isFileAllowed(config.file)) {
+    console.log(i18n.__('scanErrorFileMessage'))
+    process.exit(9)
+  } else {
+    fileUtils.checkFilePermissions(config.file)
+    const client = commonApi.getHttpClient(config)
+
+    const startUploadSpinner = oraWrapper.returnOra(i18n.__('uploadingScan'))
+    oraWrapper.startSpinner(startUploadSpinner)
+
+    return await client
+      .sendArtifact(config)
+      .then(res => {
+        if (res.statusCode === 201) {
+          oraWrapper.succeedSpinner(
+            startUploadSpinner,
+            i18n.__('uploadingScanSuccessful')
+          )
+          if (config.verbose) {
+            console.log(i18n.__('responseMessage', res.body))
+          }
+          return res.body.id
+        } else {
+          if (config.debug) {
+            console.log(res.statusCode)
+            console.log(config)
+          }
+          oraWrapper.failSpinner(
+            startUploadSpinner,
+            i18n.__('uploadingScanFail')
+          )
+          if (res.statusCode === 403) {
+            console.log(i18n.__('permissionsError'))
+            process.exit(1)
+          }
+          console.log(i18n.__('genericServiceError', res.statusCode))
+          process.exit(1)
+        }
+      })
+      .catch(err => {
+        console.log(err)
+      })
+  }
+}

package/src/scan/scanConfig.js

@@ -2,14 +2,34 @@ const paramHandler = require('../utils/paramsUtil/paramHandler')
 const constants = require('../../src/constants.js')
 const parsedCLIOptions = require('../../src/utils/parsedCLIOptions')
 const path = require('path')
+const {
+  supportedLanguages
+} = require('../audit/languageAnalysisEngine/constants')
+const i18n = require('i18n')
+const { scanUsageGuide } = require('./help')
 
 const getScanConfig = argv => {
   let scanParams = parsedCLIOptions.getCommandLineArgsCustom(
     argv,
     constants.commandLineDefinitions.scanOptionDefinitions
   )
+
+  if (scanParams.help) {
+    printHelpMessage()
+    process.exit(0)
+  }
+
   const paramsAuth = paramHandler.getAuth(scanParams)
 
+  if (scanParams.language) {
+    scanParams.language = scanParams.language.toUpperCase()
+    if (!Object.values(supportedLanguages).includes(scanParams.language)) {
+      console.log(`Did not recognise --language ${scanParams.language}`)
+      console.log(i18n.__('constantsHowToRunDev3'))
+      process.exit(1)
+    }
+  }
+
   // if no name, take the full file path and use it as the project name
   if (!scanParams.name && scanParams.file) {
     scanParams.name = getFileName(scanParams.file)
@@ -23,7 +43,12 @@ const getFileName = file => {
   return file.split(path.sep).pop()
 }
 
+const printHelpMessage = () => {
+  console.log(scanUsageGuide)
+}
+
 module.exports = {
   getScanConfig,
-  getFileName
+  getFileName,
+  printHelpMessage
 }

package/src/scan/scanController.js

@@ -9,6 +9,7 @@ const scan = require('./scan')
 const scanResults = require('./scanResults')
 const autoDetection = require('./autoDetection')
 const fileFunctions = require('./fileUtils')
+const { performance } = require('perf_hooks')
 
 const getTimeout = config => {
   if (config.timeout) {
@@ -25,7 +26,7 @@ const fileAndLanguageLogic = async configToUse => {
   if (configToUse.file) {
     if (!fileFunctions.fileExists(configToUse.file)) {
       console.log(i18n.__('fileNotExist'))
-      process.exit(0)
+      process.exit(1)
     }
     return configToUse
   } else {
@@ -36,6 +37,7 @@ const fileAndLanguageLogic = async configToUse => {
 }
 
 const startScan = async configToUse => {
+  const startTime = performance.now()
   await fileAndLanguageLogic(configToUse)
 
   if (!configToUse.projectId) {
@@ -46,7 +48,7 @@ const startScan = async configToUse => {
   const codeArtifactId = await scan.sendScan(configToUse)
 
   if (!configToUse.ff) {
-    const startScanSpinner = returnOra('Contrast Scan started')
+    const startScanSpinner = returnOra('🚀 Contrast Scan started')
     startSpinner(startScanSpinner)
     const scanDetail = await scanResults.returnScanResults(
       configToUse,
@@ -54,13 +56,19 @@ const startScan = async configToUse => {
       getTimeout(configToUse),
       startScanSpinner
     )
+
     const scanResultsInstances = await scanResults.returnScanResultsInstances(
       configToUse,
       scanDetail.id
     )
+
+    const endTime = performance.now()
+    const scanDurationMs = endTime - startTime
     succeedSpinner(startScanSpinner, 'Contrast Scan complete')
-    const projectOverview = await scanResults.returnScanProjectById(configToUse)
-    return { projectOverview, scanDetail, scanResultsInstances }
+    console.log(
+      `----- Scan completed in ${(scanDurationMs / 1000).toFixed(2)}s -----`
+    )
+    return { scanDetail, scanResultsInstances }
   }
 }
 

package/src/scan/scanResults.js

@@ -2,6 +2,7 @@ const commonApi = require('../utils/commonApi')
 const requestUtils = require('../../src/utils/requestUtils')
 const oraFunctions = require('../utils/oraWrapper')
 const _ = require('lodash')
+const i18n = require('i18n')
 
 const getScanId = async (config, codeArtifactId, client) => {
   return client
@@ -46,8 +47,23 @@ const returnScanResults = async (
         }
         if (result.body.status === 'FAILED') {
           complete = true
-          oraFunctions.failSpinner(startScanSpinner, 'Contrast Scan Failed.')
-          console.log(result.body.errorMessage)
+          oraFunctions.failSpinner(
+            startScanSpinner,
+            i18n.__(
+              'scanNotCompleted',
+              'https://docs.contrastsecurity.com/en/binary-package-preparation.html'
+            )
+          )
+          result.body.errorMessage ? console.log(result.body.errorMessage) : ''
+          if (
+            result.body.errorMessage ===
+            'Unable to determine language for code artifact'
+          ) {
+            console.log(
+              'Try scanning again using --language param. ',
+              i18n.__('scanOptionsLanguageSummary')
+            )
+          }
           process.exit(1)
         }
       }
@@ -77,23 +93,9 @@ const returnScanResultsInstances = async (config, scanId) => {
   }
 }
 
-const returnScanProjectById = async config => {
-  const client = commonApi.getHttpClient(config)
-  let result
-  try {
-    result = await client.getScanProjectById(config)
-    if (JSON.stringify(result.statusCode) == 200) {
-      return result.body
-    }
-  } catch (e) {
-    console.log(e.message.toString())
-  }
-}
-
 module.exports = {
   getScanId: getScanId,
   returnScanResults: returnScanResults,
   pollScanResults: pollScanResults,
-  returnScanResultsInstances: returnScanResultsInstances,
-  returnScanProjectById: returnScanProjectById
+  returnScanResultsInstances: returnScanResultsInstances
 }