@contrast/contrast 1.0.22 → 1.0.23

package/dist/audit/report/commonReportingFunctions.js

@@ -122,7 +122,7 @@ function buildHeader(highestSeverity, contrastHeaderNum, libraryName, version, n
 function buildBody(cveArray, advice) {
     const orderedCvesWithSeverityAssigned = orderByHighestPriority(cveArray.map(cve => findCVESeverity(cve)));
     const issueMessage = getIssueRow(orderedCvesWithSeverityAssigned);
-    const minOrMax = advice.maximum ? advice.maximum : advice.minimum;
+    const minOrMax = advice.minimum ? advice.minimum : advice.maximum;
     const displayAdvice = minOrMax
         ? `Change to version ${chalk.bold(minOrMax)}`
         : 'No recommendation is available according to our data. Upgrade to the latest stable is the best advice we can give.';

package/dist/audit/save.js

@@ -19,18 +19,24 @@ async function auditSave(config, reportId) {
             break;
     }
     if (fileFormat) {
-        if (config.experimental) {
-            save.saveFile(config, fileFormat, await sbom.generateSCASbom(config, fileFormat, reportId));
+        if (config.legacy === false) {
+            const sbomResponse = await sbom.generateSCASbom(config, fileFormat, reportId);
+            if (sbomResponse) {
+                save.saveFile(config, fileFormat, sbomResponse);
+            }
         }
         else {
-            save.saveFile(config, fileFormat, await sbom.generateSbom(config, fileFormat));
+            const sbomResponse = await sbom.generateSbom(config, fileFormat);
+            if (sbomResponse) {
+                save.saveFile(config, fileFormat, sbomResponse);
+            }
         }
         const filename = `${config.applicationId}-sbom-${fileFormat}.json`;
         if (fs.existsSync(filename)) {
             console.log(i18n.__('auditSBOMSaveSuccess') + ` - ${filename}`);
         }
         else {
-            console.log(chalk.yellow.bold(`\n Unable to save ${filename} Software Bill of Materials (SBOM)`));
+            console.log(chalk.yellow.bold(`\nUnable to save ${filename} Software Bill of Materials (SBOM)`));
         }
     }
     else {

package/dist/commands/audit/help.js

@@ -51,7 +51,6 @@ const auditUsageGuide = commandLineUsage([
             'code',
             'maven-settings-path',
             'language',
-            'experimental',
             'app-groups',
             'metadata',
             'track',

package/dist/commands/audit/processAudit.js

@@ -9,7 +9,7 @@ const processAudit = async (contrastConf, argvMain) => {
         printHelpMessage();
         process.exit(0);
     }
-    const config = await auditConfig.getAuditConfig(contrastConf, 'audit', argvMain);
+    let config = await auditConfig.getAuditConfig(contrastConf, 'audit', argvMain);
     await scaController.processSca(config);
     if (!config.fingerprint) {
         postRunMessage('audit');

package/dist/constants/constants.js

@@ -12,7 +12,7 @@ const MEDIUM = 'MEDIUM';
 const HIGH = 'HIGH';
 const CRITICAL = 'CRITICAL';
 const APP_NAME = 'contrast';
-const APP_VERSION = '1.0.22';
+const APP_VERSION = '1.0.23';
 const TIMEOUT = 120000;
 const HIGH_COLOUR = '#ff9900';
 const CRITICAL_COLOUR = '#e35858';

package/dist/sbom/generateSbom.js

@@ -10,8 +10,14 @@ const generateSbom = (config, type) => {
         if (res.statusCode === 200) {
             return res.body;
         }
+        else if (res.statusCode === 403) {
+            console.log('\nUnable to retrieve Software Bill of Materials (SBOM)');
+            console.log(`Please ensure OSS is enabled for your organization - org-id ${config.organizationId} and app ${config.applicationId}`);
+            return undefined;
+        }
         else {
             console.log('Unable to retrieve Software Bill of Materials (SBOM)');
+            return undefined;
         }
     })
         .catch((err) => {
@@ -29,6 +35,7 @@ const generateSCASbom = (config, type, reportId) => {
         }
         else {
             console.log('Unable to retrieve Software Bill of Materials (SBOM)');
+            return undefined;
         }
     })
         .catch((err) => {

package/dist/scaAnalysis/common/commonReportingFunctionsSca.js

@@ -104,9 +104,9 @@ function getIssueRow(cveArray) {
     return [chalk.bold('Issue'), ':', `${cveMessagesList.join(', ')}`];
 }
 function getAdviceRow(advice) {
-    const latestOrClosest = advice.latestStableVersion
-        ? advice.latestStableVersion
-        : advice.closestStableVersion;
+    const latestOrClosest = advice.closestStableVersion
+        ? advice.closestStableVersion
+        : advice.latestStableVersion;
     const displayAdvice = latestOrClosest
         ? `Change to version ${chalk.bold(latestOrClosest)}`
         : 'No recommendation is available according to our data. Upgrade to the latest stable is the best advice we can give.';

package/dist/scaAnalysis/common/treeUpload.js

@@ -3,13 +3,11 @@ const commonApi = require('../../utils/commonApi');
 const { APP_VERSION } = require('../../constants/constants');
 const commonSendSnapShot = async (analysis, config) => {
     let requestBody = {};
-    config.experimental === true
-        ? (requestBody = sendToSCAServices(config, analysis))
-        : (requestBody = {
-            appID: config.applicationId,
-            cliVersion: APP_VERSION,
-            snapshot: analysis
-        });
+    requestBody = {
+        appID: config.applicationId,
+        cliVersion: APP_VERSION,
+        snapshot: analysis
+    };
     const client = commonApi.getHttpClient(config);
     return client
         .sendSnapshot(requestBody, config)
@@ -28,18 +26,6 @@ const commonSendSnapShot = async (analysis, config) => {
         throw err;
     });
 };
-const sendToSCAServices = (config, analysis) => {
-    return {
-        applicationId: config.applicationId,
-        dependencyTree: analysis,
-        organizationId: config.organizationId,
-        language: config.language,
-        tool: {
-            name: 'Contrast Codesec',
-            version: APP_VERSION
-        }
-    };
-};
 module.exports = {
     commonSendSnapShot
 };

package/dist/scaAnalysis/go/goAnalysis.js

@@ -7,12 +7,7 @@ const goAnalysis = config => {
     try {
         const rawGoDependencies = goReadDepFile.getGoDependencies(config);
         const parsedGoDependencies = goParseDeps.parseGoDependencies(rawGoDependencies);
-        if (config.experimental) {
-            return parseDependenciesForSCAServices(parsedGoDependencies);
-        }
-        else {
-            return createGoTSMessage(parsedGoDependencies);
-        }
+        return createGoTSMessage(parsedGoDependencies);
     }
     catch (e) {
         console.log(e.message.toString());

package/dist/scaAnalysis/java/analysis.js

@@ -4,8 +4,6 @@ const spawn = require('cross-spawn');
 const path = require('path');
 const i18n = require('i18n');
 const fs = require('fs');
-const readLine = require('readline');
-const paramHandler = require('../../utils/paramsUtil/paramHandler');
 const MAVEN = 'maven';
 const GRADLE = 'gradle';
 const determineProjectTypeAndCwd = (files, config) => {
@@ -25,26 +23,25 @@ const determineProjectTypeAndCwd = (files, config) => {
     return projectData;
 };
 const buildMaven = (config, projectData, timeout) => {
-    let cmdStdout;
-    try {
-        let command = 'mvn';
-        let args = ['dependency:tree', '-B'];
-        if (config.mavenSettingsPath) {
-            args.push('-s');
-            args.push(config.mavenSettingsPath);
-        }
-        cmdStdout = spawn
-            .sync(command, args, {
-            env: process.env,
-            cwd: projectData.cwd,
-            timeout
-        })
-            .stdout.toString();
-        return cmdStdout.toString();
+    let command = 'mvn';
+    let args = ['dependency:tree', '-B'];
+    if (config.mavenSettingsPath) {
+        args.push('-s');
+        args.push(config.mavenSettingsPath);
     }
-    catch (err) {
-        throw new Error(i18n.__('mavenDependencyTreeNonZero', projectData.cwd, `${err.message}`));
+    const cmdDepTree = spawn.sync(command, args, {
+        env: process.env,
+        cwd: projectData.cwd,
+        timeout
+    });
+    if (cmdDepTree.status !== 0) {
+        if (config.debug && cmdDepTree.error.code === 'ENOENT') {
+            console.log(`ERROR: mvn not found`);
+            console.log('Please make sure mvn is installed and accessible');
+        }
+        throw new Error(i18n.__('mavenDependencyTreeNonZero', projectData.cwd));
     }
+    return cmdDepTree.stdout.toString();
 };
 const buildGradle = (config, projectData, timeout) => {
     let cmdStdout;
@@ -96,20 +93,15 @@ const getJavaBuildDeps = (config, files) => {
         mvnDependancyTreeOutput: undefined,
         projectType: undefined
     };
-    try {
-        const projectData = determineProjectTypeAndCwd(files, config);
-        if (projectData.projectType === MAVEN) {
-            output.mvnDependancyTreeOutput = buildMaven(config, projectData, timeout);
-        }
-        else if (projectData.projectType === GRADLE) {
-            output.mvnDependancyTreeOutput = buildGradle(config, projectData, timeout);
-        }
-        output.projectType = projectData.projectType;
-        return output;
+    const projectData = determineProjectTypeAndCwd(files, config);
+    if (projectData.projectType === MAVEN) {
+        output.mvnDependancyTreeOutput = buildMaven(config, projectData, timeout);
     }
-    catch (err) {
-        console.log(err.message.toString());
+    else if (projectData.projectType === GRADLE) {
+        output.mvnDependancyTreeOutput = buildGradle(config, projectData, timeout);
     }
+    output.projectType = projectData.projectType;
+    return output;
 };
 module.exports = {
     getJavaBuildDeps,

package/dist/scaAnalysis/java/index.js

@@ -8,12 +8,7 @@ const javaAnalysis = async (config, languageFiles) => {
         file.replace('build.gradle.kts', 'build.gradle');
     });
     const javaDeps = buildJavaTree(config, languageFiles.JAVA);
-    if (config.experimental) {
-        return parseDependenciesForSCAServices(javaDeps);
-    }
-    else {
-        return createJavaTSMessage(javaDeps);
-    }
+    return createJavaTSMessage(javaDeps);
 };
 const buildJavaTree = (config, files) => {
     const javaBuildDeps = analysis.getJavaBuildDeps(config, files);

package/dist/scaAnalysis/javascript/index.js

@@ -13,9 +13,6 @@ const jsAnalysis = async (config, languageFiles) => {
 const buildNodeTree = async (config, files) => {
     let analysis = await readFiles(config, files);
     const rawNode = await parseFiles(config, files, analysis);
-    if (config.experimental) {
-        return scaServiceParser.parseJS(rawNode);
-    }
     return formatMessage.createJavaScriptTSMessage(rawNode);
 };
 const readFiles = async (config, files) => {
@@ -42,7 +39,7 @@ const parseFiles = async (config, files, js) => {
         if (!currentLockFileVersion || !npmLockFile.packages) {
             throw new Error(`package-lock.json needs to be in the NPM v2 or v3 format. \n ${generalRebuildMessage}`);
         }
-        if (currentLockFileVersion === 3 && !config.experimental) {
+        if (currentLockFileVersion === 3) {
             throw new Error(`NPM lockfileVersion 3 is only supported when using the '-e' flag.`);
         }
         js.npmLockFile = await analysis.parseNpmLockFile(npmLockFile);

package/dist/scaAnalysis/php/index.js

@@ -1,16 +1,10 @@
 "use strict";
 const { readFile, parseProjectFiles } = require('./analysis');
 const { createPhpTSMessage } = require('../common/formatMessage');
-const { parsePHPLockFileForScaServices } = require('./phpNewServicesMapper');
 const phpAnalysis = config => {
     let analysis = readFiles(config);
-    if (config.experimental) {
-        return parsePHPLockFileForScaServices(analysis.rawLockFileContents);
-    }
-    else {
-        const phpDep = parseProjectFiles(analysis);
-        return createPhpTSMessage(phpDep);
-    }
+    const phpDep = parseProjectFiles(analysis);
+    return createPhpTSMessage(phpDep);
 };
 const readFiles = config => {
     let php = {};

package/dist/scaAnalysis/python/analysis.js

@@ -48,16 +48,10 @@ const checkForCorrectFiles = languageFiles => {
 };
 const getPythonDeps = (config, languageFiles) => {
     try {
-        if (config.experimental) {
-            let pythonLockFileContents = readLockFile(config.file);
-            return scaPythonParser(pythonLockFileContents);
-        }
-        else {
-            checkForCorrectFiles(languageFiles);
-            const parseProject = readAndParseProjectFile(config.file);
-            const parsePip = readAndParseLockFile(config.file);
-            return { pipfileLock: parsePip, pipfilDependanceies: parseProject };
-        }
+        checkForCorrectFiles(languageFiles);
+        const parseProject = readAndParseProjectFile(config.file);
+        const parsePip = readAndParseLockFile(config.file);
+        return { pipfileLock: parsePip, pipfilDependanceies: parseProject };
     }
     catch (err) {
         console.log(err.message.toString());

package/dist/scaAnalysis/python/index.js

@@ -3,12 +3,7 @@ const { createPythonTSMessage } = require('../common/formatMessage');
 const { getPythonDeps, secondaryParser } = require('./analysis');
 const pythonAnalysis = (config, languageFiles) => {
     const pythonDeps = getPythonDeps(config, languageFiles.PYTHON);
-    if (config.experimental) {
-        return pythonDeps;
-    }
-    else {
-        return createPythonTSMessage(pythonDeps);
-    }
+    return createPythonTSMessage(pythonDeps);
 };
 module.exports = {
     pythonAnalysis

package/dist/scaAnalysis/ruby/analysis.js

@@ -6,16 +6,7 @@ const getRubyDeps = (config, languageFiles) => {
         checkForCorrectFiles(languageFiles);
         const parsedGem = readAndParseGemfile(config.file);
         const parsedLock = readAndParseGemLockFile(config.file);
-        if (config.experimental) {
-            const rubyArray = removeRedundantAndPopulateDefinedElements(parsedLock.sources);
-            let rubyTree = createRubyTree(rubyArray);
-            findChildrenDependencies(rubyTree);
-            processRootDependencies(parsedLock.dependencies, rubyTree);
-            return rubyTree;
-        }
-        else {
-            return { gemfilesDependanceies: parsedGem, gemfileLock: parsedLock };
-        }
+        return { gemfilesDependanceies: parsedGem, gemfileLock: parsedLock };
     }
     catch (err) {
         throw err;

package/dist/scaAnalysis/ruby/index.js

@@ -3,12 +3,7 @@ const analysis = require('./analysis');
 const { createRubyTSMessage } = require('../common/formatMessage');
 const rubyAnalysis = (config, languageFiles) => {
     const rubyDeps = analysis.getRubyDeps(config, languageFiles.RUBY);
-    if (config.experimental) {
-        return rubyDeps;
-    }
-    else {
-        return createRubyTSMessage(rubyDeps);
-    }
+    return createRubyTSMessage(rubyDeps);
 };
 module.exports = {
     rubyAnalysis

package/dist/scaAnalysis/scaAnalysis.js

@@ -19,14 +19,8 @@ const { rubyAnalysis } = require('./ruby');
 const { pythonAnalysis } = require('./python');
 const javaAnalysis = require('./java');
 const jsAnalysis = require('./javascript');
-const auditReport = require('./common/auditReport');
-const scaUpload = require('./common/scaServicesUpload');
-const settingsHelper = require('../utils/settingsHelper');
 const chalk = require('chalk');
-const saveResults = require('../scan/saveResults');
-const { convertGenericToTypedReportModelSca } = require('./common/utils/reportUtilsSca');
 const processSca = async (config) => {
-    config = await settingsHelper.getSettings(config);
     const startTime = performance.now();
     let filesFound;
     if (config.help) {
@@ -49,17 +43,7 @@ const processSca = async (config) => {
         switch (Object.keys(filesFound[0])[0]) {
             case JAVA:
                 config.language = JAVA;
-                if (config.mode === 'repo') {
-                    try {
-                        return repoMode.buildRepo(config, filesFound[0]);
-                    }
-                    catch (e) {
-                        throw new Error('Unable to build in repository mode. Check your project file');
-                    }
-                }
-                else {
-                    messageToSend = await javaAnalysis.javaAnalysis(config, filesFound[0]);
-                }
+                messageToSend = await javaAnalysis.javaAnalysis(config, filesFound[0]);
                 break;
             case JAVASCRIPT:
                 messageToSend = await jsAnalysis.jsAnalysis(config, filesFound[0]);
@@ -82,15 +66,9 @@ const processSca = async (config) => {
                 config.language = GO;
                 break;
             case DOTNET:
-                if (config.experimental) {
-                    console.log(`${chalk.bold('\n.NET project found\n')} Language type is unsupported.`);
-                    return;
-                }
-                else {
-                    messageToSend = dotNetAnalysis(config, filesFound[0]);
-                    config.language = DOTNET;
-                    break;
-                }
+                messageToSend = dotNetAnalysis(config, filesFound[0]);
+                config.language = DOTNET;
+                break;
             default:
                 console.log('No supported language detected in project path');
                 return;
@@ -98,42 +76,22 @@ const processSca = async (config) => {
         if (!config.applicationId) {
             config.applicationId = await auditController.dealWithNoAppId(config);
         }
-        if (config.experimental) {
-            console.log('');
-            const reportSpinner = returnOra(i18n.__('auditSCAAnalysisBegins'));
-            startSpinner(reportSpinner);
-            const { reportArray, reportId } = await scaUpload.scaTreeUpload(messageToSend, config);
-            const reportModelLibraryList = convertGenericToTypedReportModelSca(reportArray);
-            auditReport.processAuditReport(config, reportModelLibraryList);
-            succeedSpinner(reportSpinner, i18n.__('auditSCAAnalysisComplete'));
-            if (config.save !== undefined) {
-                await auditSave.auditSave(config, reportId);
-            }
-            else {
-                console.log('Use contrast audit --save to generate an SBOM');
-            }
-            const endTime = performance.now() - startTime;
-            const scanDurationMs = endTime - startTime;
-            console.log(`----- completed in ${(scanDurationMs / 1000).toFixed(2)}s -----`);
+        console.log('');
+        const reportSpinner = returnOra(i18n.__('auditSCAAnalysisBegins'));
+        startSpinner(reportSpinner);
+        const snapshotResponse = await treeUpload.commonSendSnapShot(messageToSend, config);
+        await pollForSnapshotCompletion(config, snapshotResponse.id, reportSpinner);
+        succeedSpinner(reportSpinner, i18n.__('auditSCAAnalysisComplete'));
+        await vulnerabilityReportV2(config, snapshotResponse.id);
+        if (config.save !== undefined) {
+            await auditSave.auditSave(config);
         }
         else {
-            console.log('');
-            const reportSpinner = returnOra(i18n.__('auditSCAAnalysisBegins'));
-            startSpinner(reportSpinner);
-            const snapshotResponse = await treeUpload.commonSendSnapShot(messageToSend, config);
-            await pollForSnapshotCompletion(config, snapshotResponse.id, reportSpinner);
-            succeedSpinner(reportSpinner, i18n.__('auditSCAAnalysisComplete'));
-            await vulnerabilityReportV2(config, snapshotResponse.id);
-            if (config.save !== undefined) {
-                await auditSave.auditSave(config);
-            }
-            else {
-                console.log('\nUse contrast audit --save to generate an SBOM');
-            }
-            const endTime = performance.now() - startTime;
-            const scanDurationMs = endTime - startTime;
-            console.log(`----- completed in ${(scanDurationMs / 1000).toFixed(2)}s -----`);
+            console.log('\nUse contrast audit --save to generate an SBOM');
         }
+        const endTime = performance.now() - startTime;
+        const scanDurationMs = endTime - startTime;
+        console.log(`----- completed in ${(scanDurationMs / 1000).toFixed(2)}s -----`);
     }
     else {
         if (filesFound.length === 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/contrast",
-  "version": "1.0.22",
+  "version": "1.0.23",
   "description": "Contrast Security's command line tool",
   "main": "dist/index.js",
   "bin": {
@@ -27,12 +27,9 @@
     "test": "jest --testPathIgnorePatterns=./test-integration/",
     "test-int": "jest ./test-integration/",
     "test-int-scan": "jest ./test-integration/scan",
-    "test-int-audit": "jest test-integration/audit",
-    "test-int-audit-reports": "jest test-integration/audit/audit-language-reports.spec.js",
     "test-int-scan-errors": "jest test-integration/scan/scanLocalErrors.spec.js",
     "test-int-scan-reports": "jest test-integration/scan/scanReport.spec.js",
-    "test-int-audit-features": "jest test-integration/audit/auditFeatures/",
-    "test-int-audit-experimental": "jest test-integration/audit/audit-experimental.spec.js",
+    "test-int-audit-features": "jest test-integration/audit/auditFeatures",
     "format": "prettier --write \"**/*.{ts,tsx,js,json,md,yml}\" .eslintrc.*",
     "check-format": "prettier --check \"**/*.{ts,tsx,js,json,md,yml}\" .eslintrc.*",
     "coverage-local": "nyc --reporter=text mocha './test/**/*.spec.js'",

package/src/audit/report/commonReportingFunctions.js

@@ -247,7 +247,7 @@ function buildBody(cveArray, advice) {
   //todo different advice based on remediationGuidance being available or now
   // console.log(advice)
 
-  const minOrMax = advice.maximum ? advice.maximum : advice.minimum
+  const minOrMax = advice.minimum ? advice.minimum : advice.maximum
   const displayAdvice = minOrMax
     ? `Change to version ${chalk.bold(minOrMax)}`
     : 'No recommendation is available according to our data. Upgrade to the latest stable is the best advice we can give.'

package/src/audit/save.js

@@ -23,18 +23,20 @@ async function auditSave(config, reportId) {
   }
 
   if (fileFormat) {
-    if (config.experimental) {
-      save.saveFile(
+    if (config.legacy === false) {
+      const sbomResponse = await sbom.generateSCASbom(
         config,
         fileFormat,
-        await sbom.generateSCASbom(config, fileFormat, reportId)
+        reportId
       )
+      if (sbomResponse) {
+        save.saveFile(config, fileFormat, sbomResponse)
+      }
     } else {
-      save.saveFile(
-        config,
-        fileFormat,
-        await sbom.generateSbom(config, fileFormat)
-      )
+      const sbomResponse = await sbom.generateSbom(config, fileFormat)
+      if (sbomResponse) {
+        save.saveFile(config, fileFormat, sbomResponse)
+      }
     }
     const filename = `${config.applicationId}-sbom-${fileFormat}.json`
     if (fs.existsSync(filename)) {
@@ -42,7 +44,7 @@ async function auditSave(config, reportId) {
     } else {
       console.log(
         chalk.yellow.bold(
-          `\n Unable to save ${filename} Software Bill of Materials (SBOM)`
+          `\nUnable to save ${filename} Software Bill of Materials (SBOM)`
         )
       )
     }

package/src/commands/audit/help.js

@@ -51,7 +51,6 @@ const auditUsageGuide = commandLineUsage([
       'code',
       'maven-settings-path',
       'language',
-      'experimental',
       'app-groups',
       'metadata',
       'track',

package/src/commands/audit/processAudit.js

@@ -10,11 +10,8 @@ const processAudit = async (contrastConf, argvMain) => {
     process.exit(0)
   }
 
-  const config = await auditConfig.getAuditConfig(
-    contrastConf,
-    'audit',
-    argvMain
-  )
+  let config = await auditConfig.getAuditConfig(contrastConf, 'audit', argvMain)
+
   await scaController.processSca(config)
   if (!config.fingerprint) {
     postRunMessage('audit')

package/src/constants/constants.js

@@ -14,7 +14,7 @@ const HIGH = 'HIGH'
 const CRITICAL = 'CRITICAL'
 // App
 const APP_NAME = 'contrast'
-const APP_VERSION = '1.0.22'
+const APP_VERSION = '1.0.23'
 const TIMEOUT = 120000
 const HIGH_COLOUR = '#ff9900'
 const CRITICAL_COLOUR = '#e35858'

package/src/sbom/generateSbom.ts

@@ -7,8 +7,15 @@ export const generateSbom = (config: any, type: string) => {
     .then((res: { statusCode: number; body: any }) => {
       if (res.statusCode === 200) {
         return res.body
+      } else if (res.statusCode === 403) {
+        console.log('\nUnable to retrieve Software Bill of Materials (SBOM)')
+        console.log(
+          `Please ensure OSS is enabled for your organization - org-id ${config.organizationId} and app ${config.applicationId}`
+        )
+        return undefined
       } else {
         console.log('Unable to retrieve Software Bill of Materials (SBOM)')
+        return undefined
       }
     })
     .catch((err: any) => {
@@ -29,6 +36,7 @@ export const generateSCASbom = (
         return res.body
       } else {
         console.log('Unable to retrieve Software Bill of Materials (SBOM)')
+        return undefined
       }
     })
     .catch((err: any) => {

package/src/scaAnalysis/common/commonReportingFunctionsSca.js

@@ -217,9 +217,9 @@ function getIssueRow(cveArray) {
 }
 
 function getAdviceRow(advice) {
-  const latestOrClosest = advice.latestStableVersion
-    ? advice.latestStableVersion
-    : advice.closestStableVersion
+  const latestOrClosest = advice.closestStableVersion
+    ? advice.closestStableVersion
+    : advice.latestStableVersion
   const displayAdvice = latestOrClosest
     ? `Change to version ${chalk.bold(latestOrClosest)}`
     : 'No recommendation is available according to our data. Upgrade to the latest stable is the best advice we can give.'

package/src/scaAnalysis/common/treeUpload.js

@@ -3,13 +3,11 @@ const { APP_VERSION } = require('../../constants/constants')
 
 const commonSendSnapShot = async (analysis, config) => {
   let requestBody = {}
-  config.experimental === true
-    ? (requestBody = sendToSCAServices(config, analysis))
-    : (requestBody = {
-        appID: config.applicationId,
-        cliVersion: APP_VERSION,
-        snapshot: analysis
-      })
+  requestBody = {
+    appID: config.applicationId,
+    cliVersion: APP_VERSION,
+    snapshot: analysis
+  }
 
   const client = commonApi.getHttpClient(config)
   return client
@@ -33,19 +31,6 @@ const commonSendSnapShot = async (analysis, config) => {
     })
 }
 
-const sendToSCAServices = (config, analysis) => {
-  return {
-    applicationId: config.applicationId,
-    dependencyTree: analysis,
-    organizationId: config.organizationId,
-    language: config.language,
-    tool: {
-      name: 'Contrast Codesec',
-      version: APP_VERSION
-    }
-  }
-}
-
 module.exports = {
   commonSendSnapShot
 }

package/src/scaAnalysis/go/goAnalysis.js

@@ -10,12 +10,7 @@ const goAnalysis = config => {
     const rawGoDependencies = goReadDepFile.getGoDependencies(config)
     const parsedGoDependencies =
       goParseDeps.parseGoDependencies(rawGoDependencies)
-
-    if (config.experimental) {
-      return parseDependenciesForSCAServices(parsedGoDependencies)
-    } else {
-      return createGoTSMessage(parsedGoDependencies)
-    }
+    return createGoTSMessage(parsedGoDependencies)
   } catch (e) {
     console.log(e.message.toString())
   }

package/src/scaAnalysis/java/analysis.js

@@ -3,8 +3,6 @@ const spawn = require('cross-spawn')
 const path = require('path')
 const i18n = require('i18n')
 const fs = require('fs')
-const readLine = require('readline')
-const paramHandler = require('../../utils/paramsUtil/paramHandler')
 
 const MAVEN = 'maven'
 const GRADLE = 'gradle'
@@ -31,30 +29,31 @@ const determineProjectTypeAndCwd = (files, config) => {
 }
 
 const buildMaven = (config, projectData, timeout) => {
-  let cmdStdout
-  try {
-    let command = 'mvn'
-    let args = ['dependency:tree', '-B']
-    if (config.mavenSettingsPath) {
-      args.push('-s')
-      args.push(config.mavenSettingsPath)
-    }
-    // Allow users to provide a custom location for their settings.xml
+  let command = 'mvn'
+  let args = ['dependency:tree', '-B']
+  if (config.mavenSettingsPath) {
+    args.push('-s')
+    args.push(config.mavenSettingsPath)
+  }
 
-    cmdStdout = spawn
-      .sync(command, args, {
-        env: process.env,
-        cwd: projectData.cwd,
-        timeout
-      })
-      .stdout.toString()
+  // Allow users to provide a custom location for their settings.xml
+  const cmdDepTree = spawn.sync(command, args, {
+    env: process.env,
+    cwd: projectData.cwd,
+    timeout
+  })
 
-    return cmdStdout.toString()
-  } catch (err) {
-    throw new Error(
-      i18n.__('mavenDependencyTreeNonZero', projectData.cwd, `${err.message}`)
-    )
+  if (cmdDepTree.status !== 0) {
+    //if maven not found
+    if (config.debug && cmdDepTree.error.code === 'ENOENT') {
+      console.log(`ERROR: mvn not found`)
+      console.log('Please make sure mvn is installed and accessible')
+    }
+
+    throw new Error(i18n.__('mavenDependencyTreeNonZero', projectData.cwd))
   }
+
+  return cmdDepTree.stdout.toString()
 }
 
 const buildGradle = (config, projectData, timeout) => {
@@ -133,18 +132,14 @@ const getJavaBuildDeps = (config, files) => {
     projectType: undefined
   }
 
-  try {
-    const projectData = determineProjectTypeAndCwd(files, config)
-    if (projectData.projectType === MAVEN) {
-      output.mvnDependancyTreeOutput = buildMaven(config, projectData, timeout)
-    } else if (projectData.projectType === GRADLE) {
-      output.mvnDependancyTreeOutput = buildGradle(config, projectData, timeout)
-    }
-    output.projectType = projectData.projectType
-    return output
-  } catch (err) {
-    console.log(err.message.toString())
+  const projectData = determineProjectTypeAndCwd(files, config)
+  if (projectData.projectType === MAVEN) {
+    output.mvnDependancyTreeOutput = buildMaven(config, projectData, timeout)
+  } else if (projectData.projectType === GRADLE) {
+    output.mvnDependancyTreeOutput = buildGradle(config, projectData, timeout)
   }
+  output.projectType = projectData.projectType
+  return output
 }
 
 module.exports = {

package/src/scaAnalysis/java/index.js

@@ -11,12 +11,7 @@ const javaAnalysis = async (config, languageFiles) => {
   })
 
   const javaDeps = buildJavaTree(config, languageFiles.JAVA)
-
-  if (config.experimental) {
-    return parseDependenciesForSCAServices(javaDeps)
-  } else {
-    return createJavaTSMessage(javaDeps)
-  }
+  return createJavaTSMessage(javaDeps)
 }
 
 const buildJavaTree = (config, files) => {

package/src/scaAnalysis/javascript/index.js

@@ -14,11 +14,6 @@ const jsAnalysis = async (config, languageFiles) => {
 const buildNodeTree = async (config, files) => {
   let analysis = await readFiles(config, files)
   const rawNode = await parseFiles(config, files, analysis)
-
-  if (config.experimental) {
-    return scaServiceParser.parseJS(rawNode)
-  }
-
   return formatMessage.createJavaScriptTSMessage(rawNode)
 }
 
@@ -65,7 +60,7 @@ const parseFiles = async (config, files, js) => {
       )
     }
 
-    if (currentLockFileVersion === 3 && !config.experimental) {
+    if (currentLockFileVersion === 3) {
       throw new Error(
         `NPM lockfileVersion 3 is only supported when using the '-e' flag.`
       )

package/src/scaAnalysis/php/index.js

@@ -1,16 +1,10 @@
 const { readFile, parseProjectFiles } = require('./analysis')
 const { createPhpTSMessage } = require('../common/formatMessage')
-const { parsePHPLockFileForScaServices } = require('./phpNewServicesMapper')
 
 const phpAnalysis = config => {
   let analysis = readFiles(config)
-
-  if (config.experimental) {
-    return parsePHPLockFileForScaServices(analysis.rawLockFileContents)
-  } else {
-    const phpDep = parseProjectFiles(analysis)
-    return createPhpTSMessage(phpDep)
-  }
+  const phpDep = parseProjectFiles(analysis)
+  return createPhpTSMessage(phpDep)
 }
 
 const readFiles = config => {

package/src/scaAnalysis/python/analysis.js

@@ -60,16 +60,10 @@ const checkForCorrectFiles = languageFiles => {
 
 const getPythonDeps = (config, languageFiles) => {
   try {
-    if (config.experimental) {
-      let pythonLockFileContents = readLockFile(config.file)
-      return scaPythonParser(pythonLockFileContents)
-    } else {
-      checkForCorrectFiles(languageFiles)
-      const parseProject = readAndParseProjectFile(config.file)
-      const parsePip = readAndParseLockFile(config.file)
-
-      return { pipfileLock: parsePip, pipfilDependanceies: parseProject }
-    }
+    checkForCorrectFiles(languageFiles)
+    const parseProject = readAndParseProjectFile(config.file)
+    const parsePip = readAndParseLockFile(config.file)
+    return { pipfileLock: parsePip, pipfilDependanceies: parseProject }
   } catch (err) {
     console.log(err.message.toString())
     process.exit(1)

package/src/scaAnalysis/python/index.js

@@ -3,12 +3,7 @@ const { getPythonDeps, secondaryParser } = require('./analysis')
 
 const pythonAnalysis = (config, languageFiles) => {
   const pythonDeps = getPythonDeps(config, languageFiles.PYTHON)
-
-  if (config.experimental) {
-    return pythonDeps
-  } else {
-    return createPythonTSMessage(pythonDeps)
-  }
+  return createPythonTSMessage(pythonDeps)
 }
 
 module.exports = {

package/src/scaAnalysis/ruby/analysis.js

@@ -6,17 +6,7 @@ const getRubyDeps = (config, languageFiles) => {
     checkForCorrectFiles(languageFiles)
     const parsedGem = readAndParseGemfile(config.file)
     const parsedLock = readAndParseGemLockFile(config.file)
-    if (config.experimental) {
-      const rubyArray = removeRedundantAndPopulateDefinedElements(
-        parsedLock.sources
-      )
-      let rubyTree = createRubyTree(rubyArray)
-      findChildrenDependencies(rubyTree)
-      processRootDependencies(parsedLock.dependencies, rubyTree)
-      return rubyTree
-    } else {
-      return { gemfilesDependanceies: parsedGem, gemfileLock: parsedLock }
-    }
+    return { gemfilesDependanceies: parsedGem, gemfileLock: parsedLock }
   } catch (err) {
     throw err
   }

package/src/scaAnalysis/ruby/index.js

@@ -3,12 +3,7 @@ const { createRubyTSMessage } = require('../common/formatMessage')
 
 const rubyAnalysis = (config, languageFiles) => {
   const rubyDeps = analysis.getRubyDeps(config, languageFiles.RUBY)
-
-  if (config.experimental) {
-    return rubyDeps
-  } else {
-    return createRubyTSMessage(rubyDeps)
-  }
+  return createRubyTSMessage(rubyDeps)
 }
 
 module.exports = {

package/src/scaAnalysis/scaAnalysis.js

@@ -26,18 +26,10 @@ const { rubyAnalysis } = require('./ruby')
 const { pythonAnalysis } = require('./python')
 const javaAnalysis = require('./java')
 const jsAnalysis = require('./javascript')
-const auditReport = require('./common/auditReport')
-const scaUpload = require('./common/scaServicesUpload')
-const settingsHelper = require('../utils/settingsHelper')
 const chalk = require('chalk')
-const saveResults = require('../scan/saveResults')
-const {
-  convertGenericToTypedReportModelSca
-} = require('./common/utils/reportUtilsSca')
 
 const processSca = async config => {
   //checks to see whether to use old TS / new SCA path
-  config = await settingsHelper.getSettings(config)
 
   const startTime = performance.now()
   let filesFound
@@ -72,18 +64,7 @@ const processSca = async config => {
     switch (Object.keys(filesFound[0])[0]) {
       case JAVA:
         config.language = JAVA
-
-        if (config.mode === 'repo') {
-          try {
-            return repoMode.buildRepo(config, filesFound[0])
-          } catch (e) {
-            throw new Error(
-              'Unable to build in repository mode. Check your project file'
-            )
-          }
-        } else {
-          messageToSend = await javaAnalysis.javaAnalysis(config, filesFound[0])
-        }
+        messageToSend = await javaAnalysis.javaAnalysis(config, filesFound[0])
         break
       case JAVASCRIPT:
         messageToSend = await jsAnalysis.jsAnalysis(config, filesFound[0])
@@ -106,18 +87,9 @@ const processSca = async config => {
         config.language = GO
         break
       case DOTNET:
-        if (config.experimental) {
-          console.log(
-            `${chalk.bold(
-              '\n.NET project found\n'
-            )} Language type is unsupported.`
-          )
-          return
-        } else {
-          messageToSend = dotNetAnalysis(config, filesFound[0])
-          config.language = DOTNET
-          break
-        }
+        messageToSend = dotNetAnalysis(config, filesFound[0])
+        config.language = DOTNET
+        break
       default:
         //something is wrong
         console.log('No supported language detected in project path')
@@ -127,63 +99,31 @@ const processSca = async config => {
     if (!config.applicationId) {
       config.applicationId = await auditController.dealWithNoAppId(config)
     }
+    console.log('') //empty log for space before spinner
+    //send message to TS
+    const reportSpinner = returnOra(i18n.__('auditSCAAnalysisBegins'))
+    startSpinner(reportSpinner)
+    const snapshotResponse = await treeUpload.commonSendSnapShot(
+      messageToSend,
+      config
+    )
 
-    if (config.experimental) {
-      console.log('') //empty log for space before spinner
-      const reportSpinner = returnOra(i18n.__('auditSCAAnalysisBegins'))
-      startSpinner(reportSpinner)
-      const { reportArray, reportId } = await scaUpload.scaTreeUpload(
-        messageToSend,
-        config
-      )
-
-      const reportModelLibraryList =
-        convertGenericToTypedReportModelSca(reportArray)
-      auditReport.processAuditReport(config, reportModelLibraryList)
-      succeedSpinner(reportSpinner, i18n.__('auditSCAAnalysisComplete'))
-
-      if (config.save !== undefined) {
-        await auditSave.auditSave(config, reportId)
-      } else {
-        console.log('Use contrast audit --save to generate an SBOM')
-      }
+    // poll for completion
+    await pollForSnapshotCompletion(config, snapshotResponse.id, reportSpinner)
+    succeedSpinner(reportSpinner, i18n.__('auditSCAAnalysisComplete'))
 
-      const endTime = performance.now() - startTime
-      const scanDurationMs = endTime - startTime
-      console.log(
-        `----- completed in ${(scanDurationMs / 1000).toFixed(2)}s -----`
-      )
+    await vulnerabilityReportV2(config, snapshotResponse.id)
+    if (config.save !== undefined) {
+      await auditSave.auditSave(config)
     } else {
-      console.log('') //empty log for space before spinner
-      //send message to TS
-      const reportSpinner = returnOra(i18n.__('auditSCAAnalysisBegins'))
-      startSpinner(reportSpinner)
-      const snapshotResponse = await treeUpload.commonSendSnapShot(
-        messageToSend,
-        config
-      )
-
-      // poll for completion
-      await pollForSnapshotCompletion(
-        config,
-        snapshotResponse.id,
-        reportSpinner
-      )
-      succeedSpinner(reportSpinner, i18n.__('auditSCAAnalysisComplete'))
-
-      await vulnerabilityReportV2(config, snapshotResponse.id)
-      if (config.save !== undefined) {
-        await auditSave.auditSave(config)
-      } else {
-        console.log('\nUse contrast audit --save to generate an SBOM')
-      }
-      const endTime = performance.now() - startTime
-      const scanDurationMs = endTime - startTime
-
-      console.log(
-        `----- completed in ${(scanDurationMs / 1000).toFixed(2)}s -----`
-      )
+      console.log('\nUse contrast audit --save to generate an SBOM')
     }
+    const endTime = performance.now() - startTime
+    const scanDurationMs = endTime - startTime
+
+    console.log(
+      `----- completed in ${(scanDurationMs / 1000).toFixed(2)}s -----`
+    )
   } else {
     if (filesFound.length === 0) {
       console.log(i18n.__('languageAnalysisNoLanguage'))

package/dist/utils/settingsHelper.js

@@ -1,24 +0,0 @@
-"use strict";
-const commonApi = require('./commonApi');
-const { getMode } = require('./generalAPI');
-const { SAAS, MODE_BUILD } = require('../constants/constants');
-const getSettings = async (config) => {
-    config.isEOP = (await getMode(config)).toUpperCase() === SAAS ? false : true;
-    config.mode = MODE_BUILD;
-    config.scaServices = await isSCAServicesAvailable(config);
-    return config;
-};
-const isSCAServicesAvailable = async (config) => {
-    const client = commonApi.getHttpClient(config);
-    return client
-        .scaServiceHealth(config)
-        .then(res => {
-        return res.body.status === 'UP';
-    })
-        .catch(err => {
-        console.log(err);
-    });
-};
-module.exports = {
-    getSettings
-};

package/src/utils/settingsHelper.js

@@ -1,26 +0,0 @@
-const commonApi = require('./commonApi')
-const { getMode } = require('./generalAPI')
-const { SAAS, MODE_BUILD } = require('../constants/constants')
-
-const getSettings = async config => {
-  config.isEOP = (await getMode(config)).toUpperCase() === SAAS ? false : true
-  config.mode = MODE_BUILD
-  config.scaServices = await isSCAServicesAvailable(config)
-  return config
-}
-
-const isSCAServicesAvailable = async config => {
-  const client = commonApi.getHttpClient(config)
-  return client
-    .scaServiceHealth(config)
-    .then(res => {
-      return res.body.status === 'UP'
-    })
-    .catch(err => {
-      console.log(err)
-    })
-}
-
-module.exports = {
-  getSettings
-}