@contrast/contrast 1.0.3 → 1.0.4

package/.prettierignore

@@ -1,3 +1,4 @@
 test/commands/**
 dist/**
 test/errorHandling.spec.ts
+**/models

package/README.md

@@ -9,7 +9,7 @@ CodeSec delivers:
 
 ## Install
 
-```
+```shell
 npm install -g @contrast/contrast
 ```
 
@@ -23,7 +23,8 @@ In the resulting browser window, log in and authenticate with your GitHub or Goo
 
 ### SAST scan
 
-####Requirements
+#### Scan Requirements
+
 Make sure you have the correct file types to scan.
 
 - Upload a .jar or .war file to scan a Java project for analysis
@@ -36,7 +37,7 @@ Use the Contrast scan command `contrast scan`
 
 ### Lambda function scan
 
-####Requirements
+#### Lambda Requirements
 
 - Currently supports Java and Python functions on AWS.
   Configure AWS credentials on your local environment by running the commands with your credentials:
@@ -85,19 +86,24 @@ Performs a security SAST scan.
 
 **Options:**
 
-- **contrast scan --file** Path of the file you want to scan. Contrast searches for a .jar, .war .exe or .zip file in the working directory (and 3 folders deep) if a file is not specified.
-  Alias: **--f**
+- **contrast scan --file**
+
+  - Path of the file you want to scan. Contrast searches for a .jar, .war, .js. or .zip file in the working directory if a file is not specified.
+  - Alias: **--f**
 
 - **contrast scan --name**
-  Contrast project name. If not specified, Contrast creates a project from the name of the file
-  Alias: **–n**
+
+  - Contrast project name. If not specified, Contrast uses contrast.settings to identify the project or creates a project.
+  - Alias: **–n**
+
 - **contrast scan --save**
-  Download the results to a Static Analysis Results Interchange Format (SARIF) file.
-  Alias: **-s**
+
+  - Download the results to a Static Analysis Results Interchange Format (SARIF) file. The file is downloaded to the current working directory with a default name of results.sarif. You can view the file with any text editor.
+  - Alias: **-s**
 
 - **contrast scan --timeout**
-  Time in seconds to wait for the scan to complete. Default value is 300 seconds.
-  Alias: **-t**
+  - Time in seconds to wait for the scan to complete. Default value is 300 seconds.
+  - Alias: **-t**
 
 ### lambda
 
@@ -107,6 +113,9 @@ Name of AWS lambda function to scan.
 
 **Options:**
 
+- **contrast lambda --list-functions**
+  Lists all available lambda functions to scan.
+
 - **contrast lambda --function-name --endpoint-url**
   AWS Endpoint override. Similar to AWS CLI.
   Alias: **-e**
@@ -127,9 +136,6 @@ Name of AWS lambda function to scan.
   Returns extended information to the terminal.
   Alias: **-v**
 
-- **contrast lambda -–function-name --list-functions**
-  Lists all available lambda functions to scan.
-
 - **contrast lambda --function-name -–help**
   Displays usage guide.
   Alias: **-h**

package/dist/audit/languageAnalysisEngine/{langugageAnalysisFactory.js → languageAnalysisFactory.js}

@@ -9,8 +9,6 @@ const pythonAE = require('../pythonAnalysisEngine');
 const phpAE = require('../phpAnalysisEngine');
 const goAE = require('../goAnalysisEngine');
 const { vulnerabilityReport } = require('./report/reportingFeature');
-const { vulnReportWithoutDevDep } = require('./report/newReportingFeature');
-const { checkDevDeps } = require('./report/checkIgnoreDevDep');
 const { newSendSnapShot } = require('../languageAnalysisEngine/sendSnapshot');
 const fs = require('fs');
 const chalk = require('chalk');
@@ -39,15 +37,7 @@ module.exports = exports = (err, analysis) => {
         }
         console.log('\n **************CONTRAST OSS ANALYSIS BEGINS**************');
         const snapshotResponse = await newSendSnapShot(analysis, catalogueAppId);
-        if (config.report) {
-            const ignoreDevUrl = await checkDevDeps(config);
-            if (ignoreDevUrl) {
-                await vulnReportWithoutDevDep(analysis, catalogueAppId, snapshotResponse.id, config);
-            }
-            else {
-                await vulnerabilityReport(analysis, catalogueAppId, config);
-            }
-        }
+        await vulnerabilityReport(analysis, catalogueAppId, snapshotResponse.id);
         await auditSave(config);
         console.log('\n ***************CONTRAST OSS ANALYSIS COMPLETE************** \n');
     };
@@ -89,7 +79,7 @@ async function auditSave(config) {
             console.log(i18n.__('auditBadFiletypeSpecifiedForSave'));
         }
     }
-    else {
+    else if (config.save === null) {
         console.log(i18n.__('auditNoFiletypeSpecifiedForSave'));
     }
 }

package/dist/audit/languageAnalysisEngine/report/commonReportingFunctions.js

@@ -1,257 +1,85 @@
 "use strict";
-const i18n = require('i18n');
-const { getHttpClient } = require('../../../utils/commonApi');
-function displaySuccessMessageReport() {
-    console.log('\n' + i18n.__('reportSuccessMessage'));
-}
-function getAllDependenciesArray(packageJson) {
-    const { dependencies, optionalDependencies, devDependencies, peerDependencies } = packageJson;
-    const allDep = {
-        ...dependencies,
-        ...devDependencies,
-        ...optionalDependencies,
-        ...peerDependencies
-    };
-    return Object.entries(allDep);
-}
-function checkIfDepIsScoped(arrDep) {
-    let count = 0;
-    arrDep.forEach(([key, value]) => {
-        if (!key.startsWith('@')) {
-            console.log(` WARNING not scoped: ${key}:${value}`);
-            count++;
-        }
-    });
-    return count;
-}
-const dependencyRiskReport = async (packageJson, config) => {
-    const arrDep = getAllDependenciesArray(packageJson);
-    const unRegisteredDeps = await checkIfDepIsRegisteredOnNPM(arrDep, config);
-    let scopedCount = checkIfDepIsScoped(unRegisteredDeps);
-    return {
-        scopedCount: scopedCount,
-        unRegisteredCount: unRegisteredDeps.length
-    };
-};
-const checkIfDepIsRegisteredOnNPM = async (arrDep, config) => {
-    let promises = [];
-    let unRegisteredDeps = [];
-    const client = getHttpClient(config);
-    for (const [index, element] of arrDep) {
-        const query = `query artifactByGAV($name: String!, $language: String!, $groupName: String, $version: String!, $nameCheck: Boolean) {
-    artifact: exactVersion(name: $name, language: $language, groupName: $groupName, version: $version, nameCheck: $nameCheck) {
-        version
-        cves {
-            baseScore
-        }}}`;
-        const data = {
-            query: query,
-            variables: {
-                name: index,
-                version: element,
-                language: 'node',
-                nameCheck: true
-            }
-        };
-        promises.push(client.checkLibrary(data));
-    }
-    await Promise.all(promises).then(response => {
-        response.forEach(res => {
-            const libName = JSON.parse(res.request.body);
-            if (res.statusCode === 200) {
-                if (res.body.data.artifact == null) {
-                    unRegisteredDeps.push([
-                        libName.variables.name,
-                        libName.variables.version
-                    ]);
-                }
-            }
-        });
-    });
-    if (unRegisteredDeps.length !== 0) {
-        console.log('\n Dependencies Risk Report', '\n\n Private libraries that are not scoped. We recommend these libraries are reviewed and the scope claimed to prevent dependency confusion breaches');
-    }
-    return unRegisteredDeps;
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
 };
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.printFormattedOutput = exports.printVulnerabilityResponse = exports.getReport = exports.createLibraryHeader = void 0;
+const i18n_1 = __importDefault(require("i18n"));
+const commonApi_1 = require("../../../utils/commonApi");
+const reportListModel_1 = require("./models/reportListModel");
+const lodash_1 = require("lodash");
+const chalk_1 = __importDefault(require("chalk"));
+const reportUtils_1 = require("./utils/reportUtils");
+const oraWrapper_1 = require("../../../utils/oraWrapper");
 const createLibraryHeader = (id, numberOfVulnerableLibraries, numberOfCves, name) => {
     name
-        ? console.log(` Application Name: ${name} | Application ID: ${id}`)
+        ? console.log(`\n Application Name: ${name} | Application ID: ${id}`)
         : console.log(` Application ID: ${id}`);
-    console.log(` Found ${numberOfVulnerableLibraries} vulnerable libraries containing ${numberOfCves} CVE's`);
-};
-const breakPipeline = () => {
-    failOptionError();
-    process.exit(1);
-};
-const parameterOptions = hasSomeVulnerabilitiesReported => {
-    const inputtedCLIOptions = cliOptions.getCommandLineArgs();
-    let cveSeverityOption = inputtedCLIOptions['cve_severity'];
-    let fail = inputtedCLIOptions['fail'];
-    let cve_threshold = inputtedCLIOptions['cve_threshold'];
-    let expr;
-    if (cveSeverityOption && fail && cve_threshold) {
-        expr = 'SeverityAndThreshold';
-    }
-    else if (!cveSeverityOption && fail && cve_threshold) {
-        expr = 'ThresholdOnly';
-    }
-    else if (!cve_threshold && fail && hasSomeVulnerabilitiesReported[0]) {
-        expr = 'FailOnly';
-    }
-    return expr;
-};
-const analyseReportOptions = hasSomeVulnerabilitiesReported => {
-    const inputtedCLIOptions = cliOptions.getCommandLineArgs();
-    let cve_threshold = inputtedCLIOptions['cve_threshold'];
-    let cveSeverity;
-    let criticalSeverity;
-    let highSeverity;
-    let mediumSeverity;
-    let lowSeverity;
-    switch (parameterOptions(hasSomeVulnerabilitiesReported)) {
-        case 'SeverityAndThreshold':
-            cveSeverity = inputtedCLIOptions['cve_severity'].severity;
-            criticalSeverity = hasSomeVulnerabilitiesReported[2].critical;
-            highSeverity = hasSomeVulnerabilitiesReported[2].high;
-            mediumSeverity = hasSomeVulnerabilitiesReported[2].medium;
-            lowSeverity = hasSomeVulnerabilitiesReported[2].low;
-            if (cveSeverity === 'HIGH') {
-                if (cve_threshold < highSeverity + criticalSeverity) {
-                    breakPipeline();
-                }
-            }
-            if (cveSeverity === 'MEDIUM') {
-                if (cve_threshold < mediumSeverity + highSeverity) {
-                    breakPipeline();
-                }
-            }
-            if (cveSeverity === 'LOW') {
-                if (cve_threshold < lowSeverity + mediumSeverity + highSeverity) {
-                    breakPipeline();
-                }
-            }
-            break;
-        case 'ThresholdOnly':
-            if (cve_threshold < hasSomeVulnerabilitiesReported[1]) {
-                breakPipeline();
-            }
-            break;
-        case 'FailOnly':
-            breakPipeline();
-            break;
-    }
+    numberOfVulnerableLibraries === 1
+        ? console.log('\n **************************' +
+            ` Found 1 vulnerable library containing ${numberOfCves} CVE's` +
+            '************************** ')
+        : console.log('\n **************************' +
+            ` Found ${numberOfVulnerableLibraries} vulnerable libraries containing ${numberOfCves} CVE's ` +
+            '************************** ');
 };
-const getReport = async (applicationId) => {
-    const userParams = await util.getParams(applicationId);
-    const addParams = agent.getAdditionalParams();
-    const protocol = getValidHost(userParams.host);
-    const client = commonApi.getHttpClient(userParams, protocol, addParams);
+exports.createLibraryHeader = createLibraryHeader;
+const getReport = async (config, reportId) => {
+    const client = (0, commonApi_1.getHttpClient)(config);
+    const reportSpinner = (0, oraWrapper_1.returnOra)(i18n_1.default.__('auditReportWaiting'));
+    reportSpinner.indent = 1;
+    (0, oraWrapper_1.startSpinner)(reportSpinner);
     return client
-        .getReport(userParams)
-        .then(res => {
+        .getReportById(config, reportId)
+        .then((res) => {
         if (res.statusCode === 200) {
-            displaySuccessMessageReport();
+            (0, oraWrapper_1.succeedSpinner)(reportSpinner, i18n_1.default.__('auditReportSuccessMessage'));
             return res.body;
         }
         else {
-            handleResponseErrors(res, 'report');
+            (0, oraWrapper_1.failSpinner)(reportSpinner, i18n_1.default.__('auditReportFail'));
+            console.log('config-------------------');
+            console.log(config);
+            console.log('reportId----------------');
+            console.log(reportId);
+            console.log(JSON.stringify(res));
+            (0, commonApi_1.handleResponseErrors)(res, 'report');
         }
     })
-        .catch(err => {
+        .catch((err) => {
         console.log(err);
     });
 };
-const printVulnerabilityResponse = (severity, filteredVulns, vulnerabilities) => {
+exports.getReport = getReport;
+const printVulnerabilityResponse = (vulnerabilities, config) => {
     let hasSomeVulnerabilitiesReported = false;
-    if (severity) {
-        returnCveData(filteredVulns);
-        if (Object.keys(filteredVulns).length > 0)
-            hasSomeVulnerabilitiesReported = true;
-    }
-    else {
-        returnCveData(vulnerabilities);
-        if (Object.keys(vulnerabilities).length > 0)
-            hasSomeVulnerabilitiesReported = true;
+    (0, exports.printFormattedOutput)(vulnerabilities, config);
+    if (Object.keys(vulnerabilities).length > 0) {
+        hasSomeVulnerabilitiesReported = true;
     }
     return hasSomeVulnerabilitiesReported;
 };
-const returnCveData = libraries => {
-    console.log('\n ************************************************************');
-    for (const [key, value] of Object.entries(libraries)) {
-        const parts = key.split('/');
-        const nameVersion = parts[1].split('@');
-        const group = parts[0];
-        const name = nameVersion[0];
-        const version = nameVersion[1];
-        const libName = group !== 'null'
-            ? `${group}/${name}/${version} is vulnerable`
-            : `${name}/${version} is vulnerable`;
-        console.log('\n\n ' + libName);
-        value.forEach(vuln => {
-            let sevCode = vuln.severityCode || vuln.severity_code;
-            console.log('\n ' + vuln.name + ' ' + sevCode + '\n ' + vuln.description);
-        });
-    }
-};
-function searchHighCVEs(vuln) {
-    let sevCode = vuln.severityCode || vuln.severity_code;
-    if (sevCode === 'HIGH') {
-        return vuln;
-    }
-}
-function searchMediumCVEs(vuln) {
-    let sevCode = vuln.severityCode || vuln.severity_code;
-    if (sevCode === 'HIGH' || sevCode === 'MEDIUM') {
-        return vuln;
+exports.printVulnerabilityResponse = printVulnerabilityResponse;
+const printFormattedOutput = (libraries, config) => {
+    const report = new reportListModel_1.ReportList();
+    for (const library of libraries) {
+        const { name, version } = (0, reportUtils_1.findNameAndVersion)(library, config);
+        const newOutputModel = new reportListModel_1.ReportModelStructure(new reportListModel_1.ReportCompositeKey(name, version, (0, reportUtils_1.findHighestSeverityCVE)(library.cveArray)), library.cveArray);
+        report.reportOutputList.push(newOutputModel);
     }
-}
-function searchLowCVEs(vuln) {
-    let sevCode = vuln.severityCode || vuln.severity_code;
-    if (sevCode === 'HIGH' || sevCode === 'MEDIUM' || sevCode === 'LOW') {
-        return vuln;
+    const orderedOutputList = (0, lodash_1.orderBy)(report.reportOutputList, reportListItem => reportListItem.compositeKey.highestSeverity.priority);
+    for (const reportModel of orderedOutputList) {
+        const name = reportModel.compositeKey.libraryName;
+        const version = reportModel.compositeKey.libraryVersion;
+        const highestSeverity = reportModel.compositeKey.highestSeverity.severity;
+        const numOfCVEs = reportModel.cveArray.length;
+        const cveNames = [];
+        reportModel.cveArray.forEach(cve => cveNames.push(cve.name));
+        const boldHeader = chalk_1.default.bold(`${highestSeverity} | Vulnerable Library`);
+        const cvePluralised = numOfCVEs > 1 ? 'CVEs' : 'CVE';
+        console.log(`\n ${boldHeader} ${name} (${version}) has ${numOfCVEs} known ${cvePluralised}`);
+        console.log(` ${cveNames.join(', ')}`);
+        console.log(chalk_1.default.bold(' How to fix: Update to latest version'));
     }
-}
-const filterVulnerabilitiesBySeverity = (severity, vulnerabilities) => {
-    let filteredVulns = [];
-    if (severity) {
-        for (let x in vulnerabilities) {
-            if (severity.severity === 'HIGH') {
-                let highVulnerability = vulnerabilities[x].filter(searchHighCVEs);
-                if (highVulnerability.length > 0) {
-                    filteredVulns[x] = highVulnerability;
-                }
-            }
-            else if (severity.severity === 'MEDIUM') {
-                let mediumVulnerability = vulnerabilities[x].filter(searchMediumCVEs);
-                if (mediumVulnerability.length > 0) {
-                    filteredVulns[x] = mediumVulnerability;
-                }
-            }
-            else if (severity.severity === 'LOW') {
-                let lowVulnerability = vulnerabilities[x].filter(searchLowCVEs);
-                if (lowVulnerability.length > 0) {
-                    filteredVulns[x] = lowVulnerability;
-                }
-            }
-        }
-    }
-    return filteredVulns;
-};
-module.exports = {
-    displaySuccessMessageReport: displaySuccessMessageReport,
-    getAllDependenciesArray: getAllDependenciesArray,
-    dependencyRiskReport: dependencyRiskReport,
-    createLibraryHeader: createLibraryHeader,
-    breakPipeline: breakPipeline,
-    parameterOptions: parameterOptions,
-    analyseReportOptions: analyseReportOptions,
-    getReport: getReport,
-    checkIfDepIsScoped: checkIfDepIsScoped,
-    checkIfDepIsRegisteredOnNPM: checkIfDepIsRegisteredOnNPM,
-    filterVulnerabilitiesBySeverity: filterVulnerabilitiesBySeverity,
-    searchLowCVEs: searchLowCVEs,
-    searchMediumCVEs: searchMediumCVEs,
-    searchHighCVEs: searchHighCVEs,
-    returnCveData: returnCveData,
-    printVulnerabilityResponse: printVulnerabilityResponse
 };
+exports.printFormattedOutput = printFormattedOutput;

package/dist/audit/languageAnalysisEngine/report/models/reportLibraryModel.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ReportCVEModel = exports.ReportLibraryModel = void 0;
+class ReportLibraryModel {
+    constructor(name, cveArray) {
+        this.name = name;
+        this.cveArray = cveArray;
+    }
+}
+exports.ReportLibraryModel = ReportLibraryModel;
+class ReportCVEModel {
+    constructor(name, description, severityCode, cvss3SeverityCode) {
+        this.name = name;
+        this.description = description;
+        this.severityCode = severityCode;
+        this.cvss3SeverityCode = cvss3SeverityCode;
+    }
+}
+exports.ReportCVEModel = ReportCVEModel;

package/dist/audit/languageAnalysisEngine/report/models/reportListModel.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ReportCompositeKey = exports.ReportModelStructure = exports.ReportList = void 0;
+class ReportList {
+    constructor() {
+        this.reportOutputList = [];
+    }
+}
+exports.ReportList = ReportList;
+class ReportModelStructure {
+    constructor(compositeKey, cveArray) {
+        this.compositeKey = compositeKey;
+        this.cveArray = cveArray;
+    }
+}
+exports.ReportModelStructure = ReportModelStructure;
+class ReportCompositeKey {
+    constructor(libraryName, libraryVersion, highestSeverity) {
+        this.libraryName = libraryName;
+        this.libraryVersion = libraryVersion;
+        this.highestSeverity = highestSeverity;
+    }
+}
+exports.ReportCompositeKey = ReportCompositeKey;

package/dist/audit/languageAnalysisEngine/report/models/reportSeverityModel.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ReportSeverityModel = void 0;
+class ReportSeverityModel {
+    constructor(severity, priority) {
+        this.severity = severity;
+        this.priority = priority;
+    }
+}
+exports.ReportSeverityModel = ReportSeverityModel;

package/dist/audit/languageAnalysisEngine/report/reportingFeature.js

@@ -1,133 +1,28 @@
 "use strict";
-const i18n = require('i18n');
-const commonApi = require('../commonApi');
-const commonReport = require('./commonReportingFunctions');
-function displaySuccessMessageVulnerabilities() {
-    console.log(i18n.__('vulnerabilitiesSuccessMessage'));
-}
-const vulnerabilityReport = async (analysis, applicationId, config) => {
-    let depRiskReportCount = {};
-    if (analysis.language === 'NODE') {
-        depRiskReportCount = await commonReport.dependencyRiskReport(analysis.node.packageJSON, config);
-    }
-    if (config['report']) {
-        const reportResponse = await commonReport.getReport(applicationId);
-        if (reportResponse !== undefined) {
-            const libraryVulnerabilityInput = createLibraryVulnerabilityInput(reportResponse.reports);
-            const libraryVulnerabilityResponse = await getLibraryVulnerabilities(libraryVulnerabilityInput, applicationId);
-            const severity = config['cve_severity'];
-            const id = applicationId;
-            const name = config.applicationName;
-            const hasSomeVulnerabilitiesReported = formatVulnerabilityOutput(libraryVulnerabilityResponse, severity, id, name, depRiskReportCount, config);
-            commonReport.analyseReportOptions(hasSomeVulnerabilitiesReported);
-        }
-    }
-};
-const createLibraryVulnerabilityInput = report => {
-    const language = Object.keys(report[0].report)[0];
-    const reportTree = report[0].report[language].dependencyTree;
-    const libraries = reportTree[Object.keys(reportTree)[0]];
-    let gav = [];
-    for (const key of Object.keys(libraries)) {
-        gav.push({
-            name: libraries[key].name,
-            group: libraries[key].group,
-            version: libraries[key].resolved
-        });
-    }
-    return {
-        name_group_versions: gav,
-        language: language.toUpperCase()
-    };
-};
-const oldCountSeverity = vulnerableLibraries => {
-    const severityCount = {
-        critical: 0,
-        high: 0,
-        medium: 0,
-        low: 0
-    };
-    vulnerableLibraries.forEach(lib => {
-        lib.vulns.forEach(vuln => {
-            if (vuln.severity_code === 'HIGH') {
-                severityCount['high'] += 1;
-            }
-            else if (vuln.severity_code === 'MEDIUM') {
-                severityCount['medium'] += 1;
-            }
-            else if (vuln.severity_code === 'LOW') {
-                severityCount['low'] += 1;
-            }
-            else if (vuln.severity_code === 'CRITICAL') {
-                severityCount['critical'] += 1;
-            }
-        });
-    });
-    return severityCount;
-};
-const parseVulnerabilites = libraryVulnerabilityResponse => {
-    let parsedVulnerabilites = {};
-    let vulnName = libraryVulnerabilityResponse.libraries;
-    for (let x in vulnName) {
-        let vuln = vulnName[x].vulns;
-        if (vuln.length > 0) {
-            let libname = vulnName[x].group +
-                '/' +
-                vulnName[x].file_name +
-                '@' +
-                vulnName[x].file_version;
-            parsedVulnerabilites[libname] = vulnName[x].vulns;
-        }
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatVulnerabilityOutput = exports.vulnerabilityReport = void 0;
+const commonReportingFunctions_1 = require("./commonReportingFunctions");
+const reportUtils_1 = require("./utils/reportUtils");
+async function vulnerabilityReport(analysis, applicationId, reportId) {
+    const reportResponse = await (0, commonReportingFunctions_1.getReport)(analysis.config, reportId);
+    if (reportResponse !== undefined) {
+        const id = applicationId;
+        const name = analysis.config.applicationName;
+        formatVulnerabilityOutput(reportResponse.vulnerabilities, id, name, analysis.config);
     }
-    return parsedVulnerabilites;
-};
-const formatVulnerabilityOutput = (libraryVulnerabilityResponse, severity, id, name, depRiskReportCount, config) => {
-    let vulnerableLibraries = libraryVulnerabilityResponse.libraries.filter(data => {
-        return data.vulns.length > 0;
-    });
+}
+exports.vulnerabilityReport = vulnerabilityReport;
+function formatVulnerabilityOutput(libraryVulnerabilityResponse, id, name, config) {
+    const vulnerableLibraries = (0, reportUtils_1.convertGenericToTypedLibraries)(libraryVulnerabilityResponse);
     const numberOfVulnerableLibraries = vulnerableLibraries.length;
     let numberOfCves = 0;
-    vulnerableLibraries.forEach(lib => (numberOfCves += lib.vulns.length));
-    commonReport.createLibraryHeader(id, numberOfVulnerableLibraries, numberOfCves, name);
-    const severityCount = oldCountSeverity(vulnerableLibraries);
-    let vulnerabilities = parseVulnerabilites(libraryVulnerabilityResponse);
-    let filteredVulns = commonReport.filterVulnerabilitiesBySeverity(severity, vulnerabilities);
-    let hasSomeVulnerabilitiesReported;
-    hasSomeVulnerabilitiesReported = commonReport.printVulnerabilityResponse(severity, filteredVulns, vulnerabilities);
-    console.log('\n **************************' +
-        ` Found ${numberOfVulnerableLibraries} vulnerable libraries containing ${numberOfCves} CVE's ` +
-        '************************** ');
-    if (depRiskReportCount && depRiskReportCount.scopedCount === 0) {
-        console.log(' No private libraries that are not scoped detected');
-    }
-    console.log(' \n Please go to the Contrast UI to view your dependency tree: \n' +
-        ` \n ${config.host}/Contrast/static/ng/index.html#/${config.organizationId}/applications/${config.applicationId}/libs/dependency-tree`);
-    return [hasSomeVulnerabilitiesReported, numberOfCves, severityCount];
-};
-const getLibraryVulnerabilities = async (input, applicationId) => {
-    const requestBody = input;
-    const addParams = agent.getAdditionalParams();
-    const userParams = await util.getParams(applicationId);
-    const protocol = getValidHost(userParams.host);
-    const client = commonApi.getHttpClient(userParams, protocol, addParams);
-    return client
-        .getLibraryVulnerabilities(requestBody, userParams)
-        .then(res => {
-        if (res.statusCode === 200) {
-            displaySuccessMessageVulnerabilities();
-            return res.body;
-        }
-        else {
-            handleResponseErrors(res, 'vulnerabilities');
-        }
-    })
-        .catch(err => {
-        console.log(err);
-    });
-};
-module.exports = {
-    vulnerabilityReport: vulnerabilityReport,
-    getLibraryVulnerabilities: getLibraryVulnerabilities,
-    formatVulnerabilityOutput: formatVulnerabilityOutput,
-    createLibraryVulnerabilityInput: createLibraryVulnerabilityInput
-};
+    vulnerableLibraries.forEach(lib => (numberOfCves += lib.cveArray.length));
+    (0, commonReportingFunctions_1.createLibraryHeader)(id, numberOfVulnerableLibraries, numberOfCves, name);
+    const hasSomeVulnerabilitiesReported = (0, commonReportingFunctions_1.printVulnerabilityResponse)(vulnerableLibraries, config);
+    return [
+        hasSomeVulnerabilitiesReported,
+        numberOfCves,
+        (0, reportUtils_1.severityCount)(vulnerableLibraries)
+    ];
+}
+exports.formatVulnerabilityOutput = formatVulnerabilityOutput;