@contrast/contrast 1.0.2 → 1.0.5

package/dist/lambda/help.js

@@ -13,7 +13,15 @@ const lambdaUsageGuide = (0, command_line_usage_1.default)([
     },
     {
         header: i18n_1.default.__('constantsPrerequisitesHeader'),
-        content: [i18n_1.default.__('lambdaPrerequisitesContent')]
+        content: [
+            '{bold ' +
+                i18n_1.default.__('lambdaPrerequisitesContentLambdaLanguages') +
+                '}\n\n' +
+                '{bold ' +
+                i18n_1.default.__('lambdaPrerequisitesContentLambdaDescriptionTitle') +
+                '}' +
+                i18n_1.default.__('lambdaPrerequisitesContentLambdaDescription')
+        ]
     },
     {
         header: i18n_1.default.__('constantsUsage'),
@@ -23,44 +31,44 @@ const lambdaUsageGuide = (0, command_line_usage_1.default)([
         header: i18n_1.default.__('constantsOptions'),
         content: [
             {
-                name: i18n_1.default.__('lambdaFunctionNameOption'),
+                name: '{bold ' + i18n_1.default.__('lambdaFunctionNameOption') + '}',
                 summary: i18n_1.default.__('lambdaFunctionNameSummery')
             },
             {
-                name: i18n_1.default.__('lambdaListFunctionsOption'),
+                name: '{bold ' + i18n_1.default.__('lambdaListFunctionsOption') + '}',
                 summary: i18n_1.default.__('lambdaListFunctionsSummery')
             },
             {
-                name: i18n_1.default.__('lambdaEndpointOption'),
-                summary: '{italic ' +
+                name: '{bold ' + i18n_1.default.__('lambdaEndpointOption') + '}',
+                summary: '{bold ' +
                     i18n_1.default.__('constantsOptional') +
                     '}: ' +
                     i18n_1.default.__('lambdaEndpointSummery')
             },
             {
-                name: i18n_1.default.__('lambdaRegionOption'),
-                summary: '{italic ' +
+                name: '{bold ' + i18n_1.default.__('lambdaRegionOption') + '}',
+                summary: '{bold ' +
                     i18n_1.default.__('constantsOptional') +
                     '}: ' +
                     i18n_1.default.__('lambdaRegionSummery')
             },
             {
-                name: i18n_1.default.__('lambdaProfileOption'),
-                summary: '{italic ' +
+                name: '{bold ' + i18n_1.default.__('lambdaProfileOption') + '}',
+                summary: '{bold ' +
                     i18n_1.default.__('constantsOptional') +
                     '}: ' +
                     i18n_1.default.__('lambdaProfileSummery')
             },
             {
-                name: i18n_1.default.__('lambdaJsonOption'),
-                summary: '{italic ' +
+                name: '{bold ' + i18n_1.default.__('lambdaJsonOption') + '}',
+                summary: '{bold ' +
                     i18n_1.default.__('constantsOptional') +
                     '}: ' +
                     i18n_1.default.__('lambdaJsonSummery')
             },
             {
-                name: i18n_1.default.__('lambdaVerboseOption'),
-                summary: '{italic ' +
+                name: '{bold ' + i18n_1.default.__('lambdaVerboseOption') + '}',
+                summary: '{bold ' +
                     i18n_1.default.__('constantsOptional') +
                     '}: ' +
                     i18n_1.default.__('lambdaVerbosSummery')
@@ -73,7 +81,7 @@ const lambdaUsageGuide = (0, command_line_usage_1.default)([
         ]
     },
     {
-        content: '{underline https://www.contrastsecurity.com}'
+        content: '{underline https://www.contrastsecurity.com/developer/codesec}'
     }
 ]);
 exports.lambdaUsageGuide = lambdaUsageGuide;

package/dist/lambda/lambda.js

@@ -18,6 +18,8 @@ const scanRequest_1 = require("./scanRequest");
 const scanResults_1 = require("./scanResults");
 const utils_1 = require("./utils");
 const lambdaUtils_1 = require("./lambdaUtils");
+const requestUtils_1 = require("../utils/requestUtils");
+const oraWrapper_1 = __importDefault(require("../utils/oraWrapper"));
 const failedStates = [
     'UNSUPPORTED',
     'EXCLUDED',
@@ -101,6 +103,10 @@ const actualProcessLambda = async (lambdaOptions) => {
             description: failedScan.stateReasonText
         });
     }
+    const startGetherResultsSpinner = oraWrapper_1.default.returnOra(i18n_1.default.__('gatherResults'));
+    oraWrapper_1.default.startSpinner(startGetherResultsSpinner);
+    await (0, requestUtils_1.sleep)(15 * 1000);
+    oraWrapper_1.default.succeedSpinner(startGetherResultsSpinner, 'Done gathering results');
     const resultsResponse = await (0, scanResults_1.getScanResults)(auth, params, scanId, functionArn);
     if (jsonOutput) {
         console.log(JSON.stringify(resultsResponse?.data?.results, null, 2));

package/dist/sbom/generateSbom.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const commonApi_1 = require("../utils/commonApi");
+function generateSbom(config) {
+    const client = (0, commonApi_1.getHttpClient)(config);
+    return client
+        .getSbom(config)
+        .then((res) => {
+        if (res.statusCode === 200) {
+            return res.body;
+        }
+        else {
+            console.log('Unable to retrieve Software Bill of Materials (SBOM)');
+        }
+    })
+        .catch((err) => {
+        console.log(err);
+    });
+}
+exports.default = generateSbom;

package/dist/scaAnalysis/common/formatMessage.js

@@ -0,0 +1,11 @@
+"use strict";
+const createJavaTSMessage = javaTree => {
+    return {
+        java: {
+            mavenDependencyTrees: javaTree
+        }
+    };
+};
+module.exports = {
+    createJavaTSMessage
+};

package/dist/scaAnalysis/common/treeUpload.js

@@ -0,0 +1,30 @@
+"use strict";
+const { getHttpClient } = require('../../utils/commonApi');
+const { handleResponseErrors } = require('../../common/errorHandling');
+const { APP_VERSION } = require('../../constants/constants');
+const commonSendSnapShot = async (analysis, config) => {
+    const requestBody = {
+        appID: config.applicationId,
+        cliVersion: APP_VERSION,
+        snapshot: analysis
+    };
+    const client = getHttpClient(config);
+    return client
+        .sendSnapshot(requestBody, config)
+        .then(res => {
+        if (res.statusCode === 201) {
+            console.log('snapshot processed successfully');
+            return res.body;
+        }
+        else {
+            console.log(res.statusCode);
+            handleResponseErrors(res, 'snapshot');
+        }
+    })
+        .catch(err => {
+        console.log(err);
+    });
+};
+module.exports = {
+    commonSendSnapShot
+};

package/dist/scaAnalysis/java/analysis.js

@@ -0,0 +1,116 @@
+"use strict";
+const child_process = require('child_process');
+const path = require('path');
+const i18n = require('i18n');
+const fs = require('fs');
+const MAVEN = 'maven';
+const GRADLE = 'gradle';
+const determineProjectTypeAndCwd = (files, projectPath) => {
+    const projectData = {};
+    if (files[0].includes('pom.xml')) {
+        projectData.projectType = MAVEN;
+        projectData.cwd = projectPath
+            ? projectPath
+            : files[0].replace('pom.xml', '');
+    }
+    else if (files[0].includes('build.gradle')) {
+        projectData.projectType = GRADLE;
+        projectData.cwd = projectPath
+            ? projectPath
+            : files[0].replace('pom.xml', '');
+    }
+    return projectData;
+};
+const buildMaven = async (config, projectData, timeout) => {
+    let cmdStdout;
+    let mvn_settings = '';
+    try {
+        if (config.mavenSettingsPath) {
+            mvn_settings = ' -s ' + config.mavenSettingsPath;
+        }
+        cmdStdout = child_process.execSync('mvn dependency:tree -B' + mvn_settings, {
+            cwd: projectData.cwd,
+            timeout
+        });
+        return cmdStdout.toString();
+    }
+    catch (err) {
+        try {
+            child_process.execSync('mvn --version', {
+                cwd: projectData.cwd,
+                timeout
+            });
+            throw new Error(i18n.__('mavenDependencyTreeNonZero', projectData.cwd, `${err.message}`));
+        }
+        catch (mvnErr) {
+            throw new Error(i18n.__('mavenNotInstalledError', projectData.cwd, `${mvnErr.message}`));
+        }
+    }
+};
+const buildGradle = (config, projectData, timeout) => {
+    let cmdStdout;
+    let output = {};
+    try {
+        if (config.subProject) {
+            cmdStdout = child_process.execSync('.' +
+                path.sep +
+                'gradlew :' +
+                config.subProject +
+                ':dependencies --configuration runtimeClasspath', {
+                cwd: projectData.cwd,
+                timeout
+            });
+        }
+        else {
+            cmdStdout = child_process.execSync('.' +
+                path.sep +
+                'gradlew dependencies --configuration runtimeClasspath', {
+                cwd: projectData.cwd,
+                timeout
+            });
+        }
+        if (cmdStdout
+            .toString()
+            .includes("runtimeClasspath - Runtime classpath of source set 'main'.\n" +
+            'No dependencies')) {
+            cmdStdout = child_process.execSync('.' + path.sep + 'gradlew dependencies', {
+                cwd: projectData.cwd,
+                timeout
+            });
+        }
+        output.mvnDependancyTreeOutput = cmdStdout.toString();
+        return output;
+    }
+    catch (err) {
+        if (fs.existsSync(projectData.cwd + 'gradlew') ||
+            fs.existsSync(projectData.cwd + 'gradlew.bat')) {
+            throw new Error(i18n.__('gradleDependencyTreeNonZero', projectData.cwd, `${err.message}`));
+        }
+        else {
+            throw new Error(i18n.__('gradleWrapperUnavailable', projectData.cwd, `${err.message}`));
+        }
+    }
+};
+const getJavaBuildDeps = async (config, files) => {
+    const timeout = 960000;
+    let output = {
+        mvnDependancyTreeOutput: undefined,
+        projectType: undefined
+    };
+    try {
+        const projectData = determineProjectTypeAndCwd(files, config.projectPath);
+        if (projectData.projectType === MAVEN) {
+            output.mvnDependancyTreeOutput = await buildMaven(config, projectData, timeout);
+        }
+        else if (projectData.projectType === GRADLE) {
+            output.mvnDependancyTreeOutput = buildGradle(config, projectData, timeout);
+        }
+        output.projectType = projectData.projectType;
+        return output;
+    }
+    catch (err) {
+    }
+};
+module.exports = {
+    getJavaBuildDeps
+};

package/dist/scaAnalysis/java/index.js

@@ -0,0 +1,18 @@
+"use strict";
+const { getJavaBuildDeps } = require('./analysis');
+const { parseBuildDeps } = require('./javaBuildDepsParser');
+const { createJavaTSMessage } = require('../common/formatMessage');
+const javaAnalysis = async (config, languageFiles) => {
+    languageFiles.java.forEach(file => {
+        file.replace('build.gradle.kts', 'build.gradle');
+    });
+    const javaDeps = await buildJavaTree(config, languageFiles.java);
+    return createJavaTSMessage(javaDeps);
+};
+const buildJavaTree = async (config, files) => {
+    const javaBuildDeps = await getJavaBuildDeps(config, files);
+    return parseBuildDeps(config, javaBuildDeps);
+};
+module.exports = {
+    javaAnalysis
+};

package/dist/scaAnalysis/java/javaBuildDepsParser.js

@@ -0,0 +1,326 @@
+"use strict";
+const i18n = require('i18n');
+const StringBuilder = require('string-builder');
+let sb = new StringBuilder();
+const parseBuildDeps = (config, input) => {
+    const { mvnDependancyTreeOutput, projectType } = input;
+    try {
+        return parseGradle(mvnDependancyTreeOutput, config, projectType);
+    }
+    catch (err) {
+        throw new Error(i18n.__('javaParseProjectFile') + `${err.message}`);
+    }
+};
+const preParser = shavedOutput => {
+    let obj = [];
+    for (let dep in shavedOutput) {
+        obj.push(shavedOutput[dep]
+            .replace('+-', '+---')
+            .replace('[INFO]', '')
+            .replace('\\-', '\\---')
+            .replace(':jar:', ':')
+            .replace(':test', '')
+            .replace(':compile', '')
+            .replace(' +', '+')
+            .replace(' |', '|')
+            .replace(' \\', '\\')
+            .replace(':runtime', ''));
+    }
+    let depTree = [];
+    for (let x in obj) {
+        let nodeLevel = computeRelationToLastElement(obj[x]);
+        let notLastLevel = obj[x].startsWith('|') ||
+            obj[x].startsWith('+') ||
+            obj[x].startsWith('\\');
+        if (notLastLevel) {
+            if (nodeLevel === 0) {
+                depTree.push(obj[x]);
+            }
+            else {
+                let level = computeLevel(nodeLevel);
+                let validatedLevel = addIndentation(nodeLevel === 2 ? 5 : level, obj[x]);
+                depTree.push(validatedLevel);
+            }
+        }
+        else {
+            let level = computeLevel(nodeLevel);
+            let validatedLevel = addIndentation(nodeLevel === 3 ? 5 : level, obj[x]);
+            depTree.push(validatedLevel);
+        }
+    }
+    return depTree;
+};
+const shaveOutput = (gradleDependencyTreeOutput, projectType) => {
+    let shavedOutput = gradleDependencyTreeOutput.split('\n');
+    if (projectType === 'maven') {
+        shavedOutput = preParser(shavedOutput);
+    }
+    let obj = [];
+    for (let key in shavedOutput) {
+        if (shavedOutput[key].includes('project :')) {
+        }
+        else if (shavedOutput[key].includes('+---') ||
+            shavedOutput[key].includes('\\---')) {
+            obj.push(shavedOutput[key]);
+        }
+    }
+    return obj;
+};
+const computeIndentation = element => {
+    let hasPlus = element.includes('+');
+    let hasSlash = element.includes('\\');
+    if (hasPlus) {
+        return element.substring(element.indexOf('+'));
+    }
+    if (hasSlash) {
+        return element.substring(element.indexOf('\\'));
+    }
+};
+const computeLevel = nodeLevel => {
+    let num = [5, 8, 11, 14, 17, 20];
+    for (let z in num) {
+        if (num[z] === nodeLevel) {
+            let n = parseInt(z);
+            return 5 * (n + 2);
+        }
+    }
+};
+const addIndentation = (number, str) => {
+    str = computeIndentation(str);
+    sb.clear();
+    for (let j = 0; j < number; j++) {
+        sb.append(' ');
+    }
+    sb.append(str);
+    return sb.toString();
+};
+const computeRelationToLastElement = element => {
+    let hasPlus = element.includes('+---');
+    let hasSlash = element.includes('\\---');
+    if (hasPlus) {
+        return element.split('+---')[0].length;
+    }
+    if (hasSlash) {
+        return element.split('\\---')[0].length;
+    }
+};
+const stripElement = element => {
+    return element
+        .replace(/[|]/g, '')
+        .replace('+---', '')
+        .replace('\\---', '')
+        .replace(/[' ']/g, '')
+        .replace('(c)', '')
+        .replace('->', '@')
+        .replace('(*)', '');
+};
+const checkVersion = element => {
+    let version = element.split(':');
+    return version[version.length - 1];
+};
+const createElement = (element, isRoot) => {
+    let tree;
+    let cleanElement = stripElement(element);
+    let splitGroupName = cleanElement.split(':');
+    let validateVersion = false;
+    if (!element.includes('->')) {
+        validateVersion = true;
+    }
+    tree = {
+        artifactID: splitGroupName[1],
+        group: splitGroupName[0],
+        version: validateVersion
+            ? checkVersion(cleanElement)
+            : splitGroupName[splitGroupName.length - 1],
+        scope: 'compile',
+        type: isRoot ? 'direct' : 'transitive',
+        edges: {}
+    };
+    return tree;
+};
+const getElementHeader = element => {
+    let elementHeader = stripElement(element);
+    elementHeader = elementHeader.replace(':', '/');
+    elementHeader = elementHeader.replace(':', '@');
+    return elementHeader;
+};
+const buildElement = (element, rootElement, parentOfCurrent, tree, isRoot) => {
+    let childElement = createElement(element, isRoot);
+    let elementHeader = getElementHeader(element);
+    let levelsArray = [rootElement, parentOfCurrent];
+    const treeNode = getNestedObject(tree, levelsArray);
+    const rootNode = getNestedObject(tree, [rootElement]);
+    if (!rootNode.hasOwnProperty(elementHeader)) {
+        tree[rootElement][elementHeader] = childElement;
+    }
+    treeNode.edges[elementHeader] = elementHeader;
+};
+const hasChildren = (nextNodeLevel, nodeLevel) => {
+    if (nextNodeLevel > nodeLevel) {
+        return true;
+    }
+};
+const lastChild = (nextNodeLevel, nodeLevel) => {
+    if (nextNodeLevel < nodeLevel) {
+        return true;
+    }
+};
+const calculateLevels = (nextNodeLevel, nodeLevel) => {
+    return (nodeLevel - nextNodeLevel) / 5;
+};
+const buildTree = shavedOutput => {
+    let tree = {};
+    let rootElement;
+    let levelNodes = [];
+    shavedOutput.forEach((element, index) => {
+        if (index === 0) {
+            let cleanElement = stripElement(element);
+            let elementHeader = getElementHeader(cleanElement);
+            let splitElement = element.split(' ');
+            let splitGroupName = splitElement[1].split(':');
+            let validateVersion = false;
+            if (!element.includes('->')) {
+                validateVersion = true;
+            }
+            tree[splitGroupName[0]] = {};
+            tree[splitGroupName[0]][elementHeader] = {
+                artifactID: splitGroupName[1],
+                group: splitGroupName[0],
+                version: validateVersion
+                    ? checkVersion(cleanElement)
+                    : splitElement[splitElement.length - 1],
+                scope: 'compile',
+                type: 'direct',
+                edges: {}
+            };
+            rootElement = splitGroupName[0];
+            levelNodes.push(elementHeader);
+        }
+        if (shavedOutput.length - 1 === index) {
+            const parentOfCurrent = levelNodes[levelNodes.length - 1];
+            let nodeLevel = computeRelationToLastElement(element);
+            let validateVersion = false;
+            if (!element.includes('->')) {
+                validateVersion = true;
+            }
+            if (nodeLevel === 0) {
+                let cleanElement = stripElement(element);
+                let elementHeader = getElementHeader(cleanElement);
+                let splitElement = element.split(' ');
+                let splitGroupName = splitElement[1].split(':');
+                tree[rootElement][elementHeader] = {
+                    artifactID: splitGroupName[1],
+                    group: splitGroupName[0],
+                    version: validateVersion
+                        ? checkVersion(cleanElement)
+                        : splitElement[splitElement.length - 1],
+                    scope: 'compile',
+                    type: 'direct',
+                    edges: {}
+                };
+            }
+            else {
+                buildElement(element, rootElement, parentOfCurrent, tree);
+            }
+        }
+        if (index >= 1 && index < shavedOutput.length - 1) {
+            let nodeLevel = computeRelationToLastElement(element);
+            let nextNodeLevel = computeRelationToLastElement(shavedOutput[index + 1]);
+            const parentOfCurrent = levelNodes[levelNodes.length - 1];
+            let isRoot = false;
+            if (nodeLevel === 0) {
+                isRoot = true;
+            }
+            if (isRoot) {
+                let cleanElement = stripElement(element);
+                let elementHeader = getElementHeader(cleanElement);
+                let splitElement = element.split(' ');
+                let splitGroupName = splitElement[1].split(':');
+                let validateVersion = false;
+                if (!element.includes('->')) {
+                    validateVersion = true;
+                }
+                tree[rootElement][elementHeader] = {
+                    artifactID: splitGroupName[1],
+                    group: splitGroupName[0],
+                    version: validateVersion
+                        ? checkVersion(cleanElement)
+                        : splitElement[splitElement.length - 1],
+                    scope: 'compile',
+                    type: 'direct',
+                    edges: {}
+                };
+                levelNodes.push(elementHeader);
+                return;
+            }
+            let elementHeader = getElementHeader(element);
+            buildElement(element, rootElement, parentOfCurrent, tree, isRoot);
+            if (hasChildren(nextNodeLevel, nodeLevel)) {
+                buildElement(element, rootElement, parentOfCurrent, tree, isRoot);
+                levelNodes.push(elementHeader);
+            }
+            if (lastChild(nextNodeLevel, nodeLevel)) {
+                let levelDifference = calculateLevels(nextNodeLevel, nodeLevel);
+                if (levelDifference === 0) {
+                    levelNodes.pop();
+                }
+                else {
+                    let i;
+                    for (i = 0; i < levelDifference; i++) {
+                        levelNodes.pop();
+                    }
+                }
+            }
+        }
+    });
+    return tree;
+};
+const getNestedObject = (nestedObj, pathArr) => {
+    return pathArr.reduce((obj, key) => (obj && obj[key] !== 'undefined' ? obj[key] : undefined), nestedObj);
+};
+const parseSubProject = shavedOutput => {
+    let obj = [];
+    for (let key in shavedOutput) {
+        if (!shavedOutput[key].includes('project')) {
+            obj.push(shavedOutput[key]);
+        }
+    }
+    return obj;
+};
+const validateIndentation = shavedOutput => {
+    let validatedTree = [];
+    shavedOutput.forEach((element, index) => {
+        let nextNodeLevel;
+        let nodeLevel = computeRelationToLastElement(element);
+        if (shavedOutput[index + 1] !== undefined) {
+            nextNodeLevel = computeRelationToLastElement(shavedOutput[index + 1]);
+        }
+        if (index === 0) {
+            validatedTree.push(shavedOutput[index]);
+            validatedTree.push(shavedOutput[index + 1]);
+        }
+        else if (nextNodeLevel > nodeLevel + 5) {
+            return;
+        }
+        else {
+            validatedTree.push(shavedOutput[index + 1]);
+        }
+    });
+    validatedTree.pop();
+    return validatedTree;
+};
+const parseGradle = (gradleDependencyTreeOutput, config, projectType) => {
+    let shavedOutput = shaveOutput(gradleDependencyTreeOutput, projectType);
+    if (config.subProject) {
+        let subProject = parseSubProject(shavedOutput);
+        let validatedOutput = validateIndentation(subProject);
+        return buildTree(validatedOutput);
+    }
+    else {
+        let validatedOutput = validateIndentation(shavedOutput);
+        return buildTree(validatedOutput);
+    }
+};
+module.exports = {
+    parseBuildDeps
+};