@contrast/contrast 1.0.4 → 1.0.7

package/.prettierignore

@@ -1,4 +1 @@
-test/commands/**
 dist/**
-test/errorHandling.spec.ts
-**/models

package/dist/audit/autodetection/autoDetectLanguage.js

@@ -0,0 +1,32 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.determineProjectLanguage = exports.identifyLanguages = void 0;
+const i18n_1 = __importDefault(require("i18n"));
+const reduceIdentifiedLanguages_1 = require("../languageAnalysisEngine/reduceIdentifiedLanguages");
+const getProjectRootFilenames_1 = require("../languageAnalysisEngine/getProjectRootFilenames");
+function identifyLanguages(config) {
+    const { projectPath } = config;
+    const projectRootFilenames = (0, getProjectRootFilenames_1.getProjectRootFilenames)(projectPath);
+    const identifiedLanguages = projectRootFilenames.reduce((accumulator, filename) => {
+        const deducedLanguages = (0, reduceIdentifiedLanguages_1.deduceLanguage)(filename);
+        return [...accumulator, ...deducedLanguages];
+    }, []);
+    if (Object.keys(identifiedLanguages).length === 0) {
+        throw new Error(i18n_1.default.__('languageAnalysisNoLanguage', projectPath));
+    }
+    return (0, reduceIdentifiedLanguages_1.reduceIdentifiedLanguages)(identifiedLanguages);
+}
+exports.identifyLanguages = identifyLanguages;
+function determineProjectLanguage(reducedLanguages) {
+    const reducedLanguagesKeys = Object.keys(reducedLanguages);
+    if (reducedLanguagesKeys.length === 1) {
+        return reducedLanguagesKeys[0];
+    }
+    else {
+        throw new Error('Detected multiple languages. Please specify a single language using --language');
+    }
+}
+exports.determineProjectLanguage = determineProjectLanguage;

package/dist/audit/catalogueApplication/catalogueApplication.js

@@ -1,16 +1,8 @@
 "use strict";
 const i18n = require('i18n');
 const { getHttpClient, handleResponseErrors } = require('../../utils/commonApi');
-const locationOfApp = (config, appId) => {
-    return `${config.host}/Contrast/static/ng/index.html#/${config.organizationId}/applications/${appId}`;
-};
-const displaySuccessMessage = (config, appId) => {
-    console.log('\n **************************' +
-        i18n.__('successHeader') +
-        '************************** \n');
-    console.log('\n' + i18n.__('catalogueSuccessCommand') + appId + '\n');
-    console.log(locationOfApp(config, appId));
-    console.log('\n *********************************************************** \n');
+const displaySuccessMessage = () => {
+    console.log(i18n.__('catalogueSuccessCommand'));
 };
 const catalogueApplication = async (config) => {
     const client = getHttpClient(config);
@@ -19,7 +11,6 @@ const catalogueApplication = async (config) => {
         .catalogueCommand(config)
         .then(res => {
         if (res.statusCode === 201) {
-            displaySuccessMessage(config, res.body.application.app_id);
             appId = res.body.application.app_id;
         }
         else {

package/dist/audit/javaAnalysisEngine/parseMavenProjectFileContents.js

@@ -142,10 +142,12 @@ const parseMvn = mvnDependancyTreeOutput => {
     });
     return parsedDepObj;
 };
-exports.shaveConsoleOutputUntilItFindsFirsDigraphMention = shaveConsoleOutputUntilItFindsFirsDigraphMention;
+exports.shaveConsoleOutputUntilItFindsFirsDigraphMention =
+    shaveConsoleOutputUntilItFindsFirsDigraphMention;
 exports.getDigraphObjInfo = getDigraphObjInfo;
 exports.createDigraphObjKey = createDigraphObjKey;
-exports.turnDigraphDependanciesIntoArrOfInnerDep = turnDigraphDependanciesIntoArrOfInnerDep;
+exports.turnDigraphDependanciesIntoArrOfInnerDep =
+    turnDigraphDependanciesIntoArrOfInnerDep;
 exports.hasVersion = hasVersion;
 exports.formatKeyName = formatKeyName;
 exports.createOuterDependanciesAndType = createOuterDependanciesAndType;

package/dist/audit/languageAnalysisEngine/checkForMultipleIdentifiedLanguages.js

@@ -21,4 +21,5 @@ const checkForMultipleIdentifiedLanguages = identifiedLanguages => {
         throw new Error(errMsg);
     }
 };
-exports.checkForMultipleIdentifiedLanguages = checkForMultipleIdentifiedLanguages;
+exports.checkForMultipleIdentifiedLanguages =
+    checkForMultipleIdentifiedLanguages;

package/dist/audit/languageAnalysisEngine/checkForMultipleIdentifiedProjectFiles.js

@@ -21,4 +21,5 @@ const checkForMultipleIdentifiedProjectFiles = identifiedLanguages => {
         }
     }
 };
-exports.checkForMultipleIdentifiedProjectFiles = checkForMultipleIdentifiedProjectFiles;
+exports.checkForMultipleIdentifiedProjectFiles =
+    checkForMultipleIdentifiedProjectFiles;

package/dist/audit/languageAnalysisEngine/checkIdentifiedLanguageHasProjectFile.js

@@ -20,4 +20,5 @@ const checkIdentifiedLanguageHasProjectFile = identifiedLanguages => {
         }
     }
 };
-exports.checkIdentifiedLanguageHasProjectFile = checkIdentifiedLanguageHasProjectFile;
+exports.checkIdentifiedLanguageHasProjectFile =
+    checkIdentifiedLanguageHasProjectFile;

package/dist/audit/languageAnalysisEngine/languageAnalysisFactory.js

@@ -14,6 +14,8 @@ const fs = require('fs');
 const chalk = require('chalk');
 const saveFile = require('../../commands/audit/saveFile').default;
 const generateSbom = require('../../sbom/generateSbom').default;
+const { failSpinner, returnOra, startSpinner, succeedSpinner } = require('../../utils/oraWrapper');
+const { pollForSnapshotCompletition } = require('./sendSnapshot');
 module.exports = exports = (err, analysis) => {
     const { identifiedLanguageInfo } = analysis.languageAnalysis;
     const catalogueAppId = analysis.languageAnalysis.appId;
@@ -35,11 +37,13 @@ module.exports = exports = (err, analysis) => {
                 err);
             return process.exit(5);
         }
-        console.log('\n **************CONTRAST OSS ANALYSIS BEGINS**************');
+        const reportSpinner = returnOra(i18n.__('auditSCAAnalysisBegins'));
+        startSpinner(reportSpinner);
         const snapshotResponse = await newSendSnapShot(analysis, catalogueAppId);
+        const pollResult = await pollForSnapshotCompletition(analysis.config, snapshotResponse.id, reportSpinner);
+        succeedSpinner(reportSpinner, 'Contrast SCA analysis complete');
         await vulnerabilityReport(analysis, catalogueAppId, snapshotResponse.id);
         await auditSave(config);
-        console.log('\n ***************CONTRAST OSS ANALYSIS COMPLETE************** \n');
     };
     if (identifiedLanguageInfo.language === DOTNET) {
         dotnetAE(identifiedLanguageInfo, analysis.config, langCallback);

package/dist/audit/languageAnalysisEngine/reduceIdentifiedLanguages.js

@@ -22,6 +22,42 @@ function isNodeLockFilename(filename) {
 const isRubyLockFilename = filename => filename === 'Gemfile.lock';
 const isPipfileLockLockFilename = filename => filename === 'Pipfile.lock';
 const isGoProjectFilename = filename => filename === 'go.mod';
+const deduceLanguageScaAnalysis = filenames => {
+    const deducedLanguages = [];
+    let language = '';
+    filenames.forEach(filename => {
+        if (isJavaMavenProjectFilename(filename)) {
+            deducedLanguages.push(filename);
+            language = JAVA;
+        }
+        if (isJavaGradleProjectFilename(filename)) {
+            deducedLanguages.push(filename);
+            language = JAVA;
+        }
+        if (isNodeProjectFilename(filename)) {
+            deducedLanguages.push(filename);
+            language = NODE;
+        }
+        if (isRubyProjectFilename(filename)) {
+            deducedLanguages.push(filename);
+            language = RUBY;
+        }
+        if (isPythonProjectFilename(filename)) {
+            deducedLanguages.push(filename);
+            language = PYTHON;
+        }
+        if (isNodeLockFilename(filename)) {
+            deducedLanguages.push(filename);
+            language = NODE;
+        }
+        if (isGoProjectFilename(filename)) {
+            deducedLanguages.push({ language: GO, projectFilename: filename });
+            language = GO;
+        }
+    });
+    let identifiedLanguages = { [language]: deducedLanguages };
+    return identifiedLanguages;
+};
 const deduceLanguage = filename => {
     const deducedLanguages = [];
     if (isJavaMavenProjectFilename(filename)) {
@@ -90,7 +126,8 @@ module.exports = exports = (analysis, next) => {
     }
     let language = config.language;
     if (language === undefined) {
-        languageAnalysis.identifiedLanguages = reduceIdentifiedLanguages(identifiedLanguages);
+        languageAnalysis.identifiedLanguages =
+            reduceIdentifiedLanguages(identifiedLanguages);
     }
     else {
         let refinedIdentifiedLanguages = [];
@@ -119,3 +156,4 @@ exports.isPhpProjectFilename = isPhpProjectFilename;
 exports.isPhpLockFilename = isPhpLockFilename;
 exports.deduceLanguage = deduceLanguage;
 exports.reduceIdentifiedLanguages = reduceIdentifiedLanguages;
+exports.deduceLanguageScaAnalysis = deduceLanguageScaAnalysis;

package/dist/audit/languageAnalysisEngine/report/commonReportingFunctions.js

@@ -3,41 +3,29 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.printFormattedOutput = exports.printVulnerabilityResponse = exports.getReport = exports.createLibraryHeader = void 0;
-const i18n_1 = __importDefault(require("i18n"));
+exports.getNumOfAndSeverityType = exports.buildFormattedHeaderNum = exports.buildBody = exports.buildHeader = exports.printFormattedOutput = exports.printVulnerabilityResponse = exports.getReport = exports.createLibraryHeader = void 0;
 const commonApi_1 = require("../../../utils/commonApi");
 const reportListModel_1 = require("./models/reportListModel");
 const lodash_1 = require("lodash");
 const chalk_1 = __importDefault(require("chalk"));
 const reportUtils_1 = require("./utils/reportUtils");
-const oraWrapper_1 = require("../../../utils/oraWrapper");
-const createLibraryHeader = (id, numberOfVulnerableLibraries, numberOfCves, name) => {
-    name
-        ? console.log(`\n Application Name: ${name} | Application ID: ${id}`)
-        : console.log(` Application ID: ${id}`);
+const severityCountModel_1 = require("./models/severityCountModel");
+const reportOutputModel_1 = require("./models/reportOutputModel");
+const createLibraryHeader = (id, numberOfVulnerableLibraries, numberOfCves) => {
     numberOfVulnerableLibraries === 1
-        ? console.log('\n **************************' +
-            ` Found 1 vulnerable library containing ${numberOfCves} CVE's` +
-            '************************** ')
-        : console.log('\n **************************' +
-            ` Found ${numberOfVulnerableLibraries} vulnerable libraries containing ${numberOfCves} CVE's ` +
-            '************************** ');
+        ? console.log(` Found 1 vulnerable library containing ${numberOfCves} CVE's`)
+        : console.log(` Found ${numberOfVulnerableLibraries} vulnerable libraries containing ${numberOfCves} CVE's `);
 };
 exports.createLibraryHeader = createLibraryHeader;
 const getReport = async (config, reportId) => {
     const client = (0, commonApi_1.getHttpClient)(config);
-    const reportSpinner = (0, oraWrapper_1.returnOra)(i18n_1.default.__('auditReportWaiting'));
-    reportSpinner.indent = 1;
-    (0, oraWrapper_1.startSpinner)(reportSpinner);
     return client
         .getReportById(config, reportId)
         .then((res) => {
         if (res.statusCode === 200) {
-            (0, oraWrapper_1.succeedSpinner)(reportSpinner, i18n_1.default.__('auditReportSuccessMessage'));
             return res.body;
         }
         else {
-            (0, oraWrapper_1.failSpinner)(reportSpinner, i18n_1.default.__('auditReportFail'));
             console.log('config-------------------');
             console.log(config);
             console.log('reportId----------------');
@@ -67,19 +55,70 @@ const printFormattedOutput = (libraries, config) => {
         const newOutputModel = new reportListModel_1.ReportModelStructure(new reportListModel_1.ReportCompositeKey(name, version, (0, reportUtils_1.findHighestSeverityCVE)(library.cveArray)), library.cveArray);
         report.reportOutputList.push(newOutputModel);
     }
-    const orderedOutputList = (0, lodash_1.orderBy)(report.reportOutputList, reportListItem => reportListItem.compositeKey.highestSeverity.priority);
-    for (const reportModel of orderedOutputList) {
-        const name = reportModel.compositeKey.libraryName;
-        const version = reportModel.compositeKey.libraryVersion;
-        const highestSeverity = reportModel.compositeKey.highestSeverity.severity;
+    const orderedOutputListLowestFirst = (0, lodash_1.orderBy)(report.reportOutputList, reportListItem => reportListItem.compositeKey.highestSeverity.priority, ['desc']);
+    let contrastHeaderNumCounter = 0;
+    for (const reportModel of orderedOutputListLowestFirst) {
+        contrastHeaderNumCounter++;
+        const { libraryName, libraryVersion, highestSeverity } = reportModel.compositeKey;
         const numOfCVEs = reportModel.cveArray.length;
-        const cveNames = [];
-        reportModel.cveArray.forEach(cve => cveNames.push(cve.name));
-        const boldHeader = chalk_1.default.bold(`${highestSeverity} | Vulnerable Library`);
-        const cvePluralised = numOfCVEs > 1 ? 'CVEs' : 'CVE';
-        console.log(`\n ${boldHeader} ${name} (${version}) has ${numOfCVEs} known ${cvePluralised}`);
-        console.log(` ${cveNames.join(', ')}`);
-        console.log(chalk_1.default.bold(' How to fix: Update to latest version'));
+        const header = buildHeader(highestSeverity, contrastHeaderNumCounter, libraryName, libraryVersion, numOfCVEs);
+        const body = buildBody(reportModel.cveArray);
+        const reportOutputModel = new reportOutputModel_1.ReportOutputModel(header, body);
+        console.log(reportOutputModel.header.vulnMessage, reportOutputModel.header.introducesMessage);
+        console.log(reportOutputModel.body.issueMessage);
+        console.log(reportOutputModel.body.adviceMessage);
     }
 };
 exports.printFormattedOutput = printFormattedOutput;
+function buildHeader(highestSeverity, contrastHeaderNum, libraryName, version, numOfCVEs) {
+    const vulnerabilityPluralised = numOfCVEs > 1 ? 'Vulnerabilities' : 'Vulnerability';
+    const formattedHeaderNum = buildFormattedHeaderNum(contrastHeaderNum);
+    const vulnMessage = chalk_1.default
+        .hex(highestSeverity.outputColour)
+        .bold(`${formattedHeaderNum} - [${highestSeverity.severity}] ${libraryName}-${version}`);
+    const introducesMessage = chalk_1.default.bold(`introduces ${numOfCVEs} ${vulnerabilityPluralised}`);
+    return new reportOutputModel_1.ReportOutputHeaderModel(vulnMessage, introducesMessage);
+}
+exports.buildHeader = buildHeader;
+function buildBody(cveArray) {
+    const cveMessages = [];
+    (0, reportUtils_1.findCVESeveritiesAndOrderByHighestPriority)(cveArray).forEach(reportSeverityModel => {
+        const { outputColour, severity, cveName } = reportSeverityModel;
+        const severityShorthand = chalk_1.default
+            .hex(outputColour)
+            .bold(`[${severity.charAt(0).toUpperCase()}]`);
+        const builtMessage = `${severityShorthand} ${cveName}`;
+        cveMessages.push(builtMessage);
+    });
+    const numAndSeverityType = getNumOfAndSeverityType(cveArray);
+    const issueMessage = ` ${chalk_1.default.bold('Issue')}  : ${numAndSeverityType} ${cveMessages.join(', ')}.`;
+    const adviceMessage = ` ${chalk_1.default.bold('Advice')} : ${chalk_1.default.bold('Update to latest version')}.`;
+    return new reportOutputModel_1.ReportOutputBodyModel(issueMessage, adviceMessage);
+}
+exports.buildBody = buildBody;
+function buildFormattedHeaderNum(contrastHeaderNum) {
+    let formattedHeaderNum;
+    if (contrastHeaderNum < 10) {
+        formattedHeaderNum = `00${contrastHeaderNum}`;
+    }
+    else if (contrastHeaderNum >= 10 && contrastHeaderNum < 100) {
+        formattedHeaderNum = `0${contrastHeaderNum}`;
+    }
+    else if (contrastHeaderNum >= 100) {
+        formattedHeaderNum = contrastHeaderNum;
+    }
+    return `CONTRAST-${formattedHeaderNum}`;
+}
+exports.buildFormattedHeaderNum = buildFormattedHeaderNum;
+function getNumOfAndSeverityType(cveArray) {
+    const { critical, high, medium, low, note } = (0, reportUtils_1.severityCountAllCVEs)(cveArray, new severityCountModel_1.SeverityCountModel());
+    const criticalMessage = critical > 0 ? `${critical} Critical` : '';
+    const highMessage = high > 0 ? `${high} High` : '';
+    const mediumMessage = medium > 0 ? `${medium} Medium` : '';
+    const lowMessage = low > 0 ? `${low} Low` : '';
+    const noteMessage = note > 0 ? `${note} Note` : '';
+    return `${criticalMessage} ${highMessage} ${mediumMessage} ${lowMessage} ${noteMessage}`
+        .replace(/\s+/g, ' ')
+        .trim();
+}
+exports.getNumOfAndSeverityType = getNumOfAndSeverityType;

package/dist/audit/languageAnalysisEngine/report/models/reportOutputModel.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ReportOutputBodyModel = exports.ReportOutputHeaderModel = exports.ReportOutputModel = void 0;
+class ReportOutputModel {
+    constructor(header, body) {
+        this.header = header;
+        this.body = body;
+    }
+}
+exports.ReportOutputModel = ReportOutputModel;
+class ReportOutputHeaderModel {
+    constructor(vulnMessage, introducesMessage) {
+        this.vulnMessage = vulnMessage;
+        this.introducesMessage = introducesMessage;
+    }
+}
+exports.ReportOutputHeaderModel = ReportOutputHeaderModel;
+class ReportOutputBodyModel {
+    constructor(bodyIssueMessage, bodyAdviceMessage) {
+        this.issueMessage = bodyIssueMessage;
+        this.adviceMessage = bodyAdviceMessage;
+    }
+}
+exports.ReportOutputBodyModel = ReportOutputBodyModel;

package/dist/audit/languageAnalysisEngine/report/models/reportSeverityModel.js

@@ -2,9 +2,11 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ReportSeverityModel = void 0;
 class ReportSeverityModel {
-    constructor(severity, priority) {
+    constructor(severity, priority, outputColour, cveName) {
         this.severity = severity;
         this.priority = priority;
+        this.outputColour = outputColour;
+        this.cveName = cveName;
     }
 }
 exports.ReportSeverityModel = ReportSeverityModel;

package/dist/audit/languageAnalysisEngine/report/models/severityCountModel.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SeverityCountModel = void 0;
+class SeverityCountModel {
+    constructor() {
+        this.critical = 0;
+        this.high = 0;
+        this.medium = 0;
+        this.low = 0;
+        this.note = 0;
+    }
+}
+exports.SeverityCountModel = SeverityCountModel;

package/dist/audit/languageAnalysisEngine/report/reportingFeature.js

@@ -17,12 +17,12 @@ function formatVulnerabilityOutput(libraryVulnerabilityResponse, id, name, confi
     const numberOfVulnerableLibraries = vulnerableLibraries.length;
     let numberOfCves = 0;
     vulnerableLibraries.forEach(lib => (numberOfCves += lib.cveArray.length));
-    (0, commonReportingFunctions_1.createLibraryHeader)(id, numberOfVulnerableLibraries, numberOfCves, name);
+    (0, commonReportingFunctions_1.createLibraryHeader)(id, numberOfVulnerableLibraries, numberOfCves);
     const hasSomeVulnerabilitiesReported = (0, commonReportingFunctions_1.printVulnerabilityResponse)(vulnerableLibraries, config);
     return [
         hasSomeVulnerabilitiesReported,
         numberOfCves,
-        (0, reportUtils_1.severityCount)(vulnerableLibraries)
+        (0, reportUtils_1.severityCountAllLibraries)(vulnerableLibraries)
     ];
 }
 exports.formatVulnerabilityOutput = formatVulnerabilityOutput;

package/dist/audit/languageAnalysisEngine/report/utils/reportUtils.js

@@ -3,70 +3,81 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.findNameAndVersion = exports.severityCount = exports.convertGenericToTypedLibraries = exports.findHighestSeverityCVE = void 0;
+exports.findNameAndVersion = exports.severityCountSingleCVE = exports.severityCountAllCVEs = exports.severityCountAllLibraries = exports.convertGenericToTypedLibraries = exports.findCVESeverity = exports.findCVESeveritiesAndOrderByHighestPriority = exports.findHighestSeverityCVE = void 0;
 const reportLibraryModel_1 = require("../models/reportLibraryModel");
 const reportSeverityModel_1 = require("../models/reportSeverityModel");
 const constants_1 = __importDefault(require("../../../languageAnalysisEngine/constants"));
+const constants_2 = require("../../../../constants/constants");
+const lodash_1 = require("lodash");
+const severityCountModel_1 = require("../models/severityCountModel");
 const { supportedLanguages: { GO } } = constants_1.default;
 function findHighestSeverityCVE(cveArray) {
-    if (cveArray.find(cve => cve.cvss3SeverityCode === 'CRITICAL' || cve.severityCode === 'CRITICAL')) {
-        return new reportSeverityModel_1.ReportSeverityModel('CRITICAL', 1);
+    const mappedToReportSeverityModels = cveArray.map(cve => findCVESeverity(cve));
+    return (0, lodash_1.orderBy)(mappedToReportSeverityModels, cve => cve?.priority)[0];
+}
+exports.findHighestSeverityCVE = findHighestSeverityCVE;
+function findCVESeveritiesAndOrderByHighestPriority(cves) {
+    return (0, lodash_1.orderBy)(cves.map(cve => findCVESeverity(cve)), ['priority'], ['asc']);
+}
+exports.findCVESeveritiesAndOrderByHighestPriority = findCVESeveritiesAndOrderByHighestPriority;
+function findCVESeverity(cve) {
+    const cveName = cve.name;
+    if (cve.cvss3SeverityCode === 'CRITICAL' || cve.severityCode === 'CRITICAL') {
+        return new reportSeverityModel_1.ReportSeverityModel('CRITICAL', constants_2.CRITICAL_PRIORITY, constants_2.CRITICAL_COLOUR, cveName);
     }
-    else if (cveArray.find(cve => cve.cvss3SeverityCode === 'HIGH' || cve.severityCode === 'HIGH')) {
-        return new reportSeverityModel_1.ReportSeverityModel('HIGH', 2);
+    else if (cve.cvss3SeverityCode === 'HIGH' || cve.severityCode === 'HIGH') {
+        return new reportSeverityModel_1.ReportSeverityModel('HIGH', constants_2.HIGH_PRIORITY, constants_2.HIGH_COLOUR, cveName);
     }
-    else if (cveArray.find(cve => cve.cvss3SeverityCode === 'MEDIUM' || cve.severityCode === 'MEDIUM')) {
-        return new reportSeverityModel_1.ReportSeverityModel('MEDIUM', 3);
+    else if (cve.cvss3SeverityCode === 'MEDIUM' ||
+        cve.severityCode === 'MEDIUM') {
+        return new reportSeverityModel_1.ReportSeverityModel('MEDIUM', constants_2.MEDIUM_PRIORITY, constants_2.MEDIUM_COLOUR, cveName);
     }
-    else if (cveArray.find(cve => cve.cvss3SeverityCode === 'LOW' || cve.severityCode === 'LOW')) {
-        return new reportSeverityModel_1.ReportSeverityModel('LOW', 4);
+    else if (cve.cvss3SeverityCode === 'LOW' || cve.severityCode === 'LOW') {
+        return new reportSeverityModel_1.ReportSeverityModel('LOW', constants_2.LOW_PRIORITY, constants_2.LOW_COLOUR, cveName);
     }
-    else if (cveArray.find(cve => cve.cvss3SeverityCode === 'NOTE' || cve.severityCode === 'NOTE')) {
-        return new reportSeverityModel_1.ReportSeverityModel('NOTE', 5);
+    else if (cve.cvss3SeverityCode === 'NOTE' || cve.severityCode === 'NOTE') {
+        return new reportSeverityModel_1.ReportSeverityModel('NOTE', constants_2.NOTE_PRIORITY, constants_2.NOTE_COLOUR, cveName);
     }
 }
-exports.findHighestSeverityCVE = findHighestSeverityCVE;
+exports.findCVESeverity = findCVESeverity;
 function convertGenericToTypedLibraries(libraries) {
     return Object.entries(libraries).map(([name, cveArray]) => {
         return new reportLibraryModel_1.ReportLibraryModel(name, cveArray);
     });
 }
 exports.convertGenericToTypedLibraries = convertGenericToTypedLibraries;
-function severityCount(vulnerableLibraries) {
-    const severityCount = {
-        critical: 0,
-        high: 0,
-        medium: 0,
-        low: 0,
-        note: 0
-    };
-    vulnerableLibraries.forEach(lib => {
-        lib.cveArray.forEach(cve => {
-            if (cve.cvss3SeverityCode === 'CRITICAL' ||
-                cve.severityCode === 'CRITICAL') {
-                severityCount['critical'] += 1;
-            }
-            else if (cve.cvss3SeverityCode === 'HIGH' ||
-                cve.severityCode === 'HIGH') {
-                severityCount['high'] += 1;
-            }
-            else if (cve.cvss3SeverityCode === 'MEDIUM' ||
-                cve.severityCode === 'MEDIUM') {
-                severityCount['medium'] += 1;
-            }
-            else if (cve.cvss3SeverityCode === 'LOW' ||
-                cve.severityCode === 'LOW') {
-                severityCount['low'] += 1;
-            }
-            else if (cve.cvss3SeverityCode === 'NOTE' ||
-                cve.severityCode === 'NOTE') {
-                severityCount['note'] += 1;
-            }
-        });
-    });
+function severityCountAllLibraries(vulnerableLibraries) {
+    const severityCount = new severityCountModel_1.SeverityCountModel();
+    vulnerableLibraries.forEach(lib => severityCountAllCVEs(lib.cveArray, severityCount));
+    return severityCount;
+}
+exports.severityCountAllLibraries = severityCountAllLibraries;
+function severityCountAllCVEs(cveArray, severityCount) {
+    const severityCountInner = severityCount;
+    cveArray.forEach(cve => severityCountSingleCVE(cve, severityCountInner));
+    return severityCountInner;
+}
+exports.severityCountAllCVEs = severityCountAllCVEs;
+function severityCountSingleCVE(cve, severityCount) {
+    if (cve.cvss3SeverityCode === 'CRITICAL' || cve.severityCode === 'CRITICAL') {
+        severityCount.critical += 1;
+    }
+    else if (cve.cvss3SeverityCode === 'HIGH' || cve.severityCode === 'HIGH') {
+        severityCount.high += 1;
+    }
+    else if (cve.cvss3SeverityCode === 'MEDIUM' ||
+        cve.severityCode === 'MEDIUM') {
+        severityCount.medium += 1;
+    }
+    else if (cve.cvss3SeverityCode === 'LOW' || cve.severityCode === 'LOW') {
+        severityCount.low += 1;
+    }
+    else if (cve.cvss3SeverityCode === 'NOTE' || cve.severityCode === 'NOTE') {
+        severityCount.note += 1;
+    }
     return severityCount;
 }
-exports.severityCount = severityCount;
+exports.severityCountSingleCVE = severityCountSingleCVE;
 function findNameAndVersion(library, config) {
     if (config.language.toUpperCase() === GO) {
         const nameVersion = library.name.split('@');

package/dist/audit/languageAnalysisEngine/sendSnapshot.js

@@ -1,32 +1,25 @@
 "use strict";
-const prettyjson = require('prettyjson');
-const i18n = require('i18n');
-const { getHttpClient } = require('../../utils/commonApi');
 const { handleResponseErrors } = require('../../common/errorHandling');
 const { APP_VERSION } = require('../../constants/constants');
-function displaySnapshotSuccessMessage(config) {
-    console.log('\n **************************' +
-        i18n.__('successHeader') +
-        '************************** ');
-    console.log('\n' + i18n.__('snapshotSuccessMessage') + '\n');
-    console.log(` ${config.host}/Contrast/static/ng/index.html#/${config.organizationId}/applications/${config.applicationId}/libs/dependency-tree`);
-    console.log('\n ***********************************************************');
-}
-const newSendSnapShot = async (analysis, applicationId) => {
+const commonApi = require('../../utils/commonApi');
+const _ = require('lodash');
+const oraFunctions = require('../../utils/oraWrapper');
+const i18n = require('i18n');
+const oraWrapper = require('../../utils/oraWrapper');
+const requestUtils = require('../../utils/requestUtils');
+const { performance } = require('perf_hooks');
+const newSendSnapShot = async (analysis) => {
     const analysisLanguage = analysis.config.language.toLowerCase();
     const requestBody = {
         appID: analysis.config.applicationId,
         cliVersion: APP_VERSION,
         snapshot: { [analysisLanguage]: analysis[analysisLanguage] }
     };
-    const client = getHttpClient(analysis.config);
+    const client = commonApi.getHttpClient(analysis.config);
     return client
         .sendSnapshot(requestBody, analysis.config)
         .then(res => {
         if (res.statusCode === 201) {
-            if (analysis.config.host !== 'https://ce.contrastsecurity.com/') {
-                displaySnapshotSuccessMessage(analysis.config);
-            }
             return res.body;
         }
         else {
@@ -37,7 +30,62 @@ const newSendSnapShot = async (analysis, applicationId) => {
         console.log(err);
     });
 };
+const pollSnapshotResults = async (config, snapshotId, client) => {
+    await requestUtils.sleep(5000);
+    return client
+        .getReportStatusById(config, snapshotId)
+        .then(res => {
+        return res;
+    })
+        .catch(err => {
+        console.log(err);
+    });
+};
+const getTimeout = config => {
+    if (config.timeout) {
+        return config.timeout;
+    }
+    else {
+        if (config.verbose) {
+            console.log('Timeout set to 2 minutes');
+        }
+        return 120;
+    }
+};
+const pollForSnapshotCompletition = async (config, snapshotId, reportSpinner) => {
+    const client = commonApi.getHttpClient(config);
+    const startTime = performance.now();
+    const timeout = getTimeout(config);
+    let complete = false;
+    if (!_.isNil(snapshotId)) {
+        while (!complete) {
+            let result = await pollSnapshotResults(config, snapshotId, client);
+            if (result.statusCode === 200) {
+                if (result.body.status === 'PROCESSED') {
+                    complete = true;
+                    return result.body;
+                }
+                if (result.body.status === 'FAILED') {
+                    complete = true;
+                    if (config.debug) {
+                        oraFunctions.failSpinner(reportSpinner, i18n.__('auditNotCompleted'));
+                    }
+                    console.log(result.body.errorMessage);
+                    oraWrapper.stopSpinner(reportSpinner);
+                    console.log('Contrast audit finished');
+                    process.exit(1);
+                }
+            }
+            const endTime = performance.now() - startTime;
+            if (requestUtils.millisToSeconds(endTime) > timeout) {
+                oraFunctions.failSpinner(reportSpinner, 'Contrast audit timed out at the specified ' + timeout + ' seconds.');
+                console.log('Please try again, allowing more time.');
+                process.exit(1);
+            }
+        }
+    }
+};
 module.exports = {
     newSendSnapShot: newSendSnapShot,
-    displaySnapshotSuccessMessage: displaySnapshotSuccessMessage
+    pollForSnapshotCompletition: pollForSnapshotCompletition
 };