@contrast/contrast 1.0.4 → 1.0.7

package/src/scaAnalysis/ruby/analysis.js

@@ -0,0 +1,282 @@
+const fs = require('fs')
+
+const readAndParseGemfile = projectPath => {
+  const fileName = filePathForWindows(projectPath + '/Gemfile')
+  const gemFile = fs.readFileSync(fileName, 'utf8')
+  const rubyArray = gemFile.split('\n')
+
+  let filteredRubyDep = rubyArray.filter(element => {
+    return (
+      !element.includes('#') &&
+      element.includes('gem') &&
+      !element.includes('source')
+    )
+  })
+
+  for (let i = 0; i < filteredRubyDep.length; i++) {
+    filteredRubyDep[i] = filteredRubyDep[i].trim()
+  }
+
+  return filteredRubyDep
+}
+
+const readAndParseGemLockFile = projectPath => {
+  const fileName = filePathForWindows(projectPath + '/Gemfile.lock')
+  const lockFile = fs.readFileSync(fileName, 'utf8')
+  const dependencyRegEx = /^\s*([A-Za-z0-9.!@#$%\-^&*_+]*)\s*(\((.*?)\))/
+
+  const lines = lockFile.split('\n')
+
+  return {
+    dependencies: getDirectDependencies(lines, dependencyRegEx),
+    runtimeDetails: getLockFileRuntimeInfo(lines),
+    sources: getSourceArray(lines, dependencyRegEx)
+  }
+}
+
+const nonDependencyKeys = (line, sourceObject) => {
+  const GEMFILE_KEY_VALUE = /^\s*([^:(]*)\s*\s*(.*)/
+  let parts = GEMFILE_KEY_VALUE.exec(line)
+  let key = parts[1].trim()
+  let value = parts[2] || ''
+
+  sourceObject[key] = value
+  return sourceObject
+}
+
+const populateResolveAndPlatform = (version, sourceObject) => {
+  const depArr = version.split('-')
+  sourceObject.resolved = depArr[0]
+  sourceObject.platform = depArr.length > 1 ? depArr[1] : 'UNSPECIFIED'
+  return sourceObject
+}
+
+const isUpperCase = str => {
+  return str === str.toUpperCase()
+}
+
+const getDirectDependencies = (lines, dependencyRegEx) => {
+  const dependencies = {}
+
+  let depIndex = 0
+  for (let i = 0; i < lines.length; i++) {
+    if (lines[i] === 'DEPENDENCIES') {
+      depIndex = i
+    }
+  }
+  const getDepArray = lines.slice(depIndex)
+
+  for (let j = 1; j < getDepArray.length; j++) {
+    const element = getDepArray[j]
+    if (!isUpperCase(element)) {
+      const isDependencyWithVersion = dependencyRegEx.test(element)
+      if (isDependencyWithVersion) {
+        const dependency = dependencyRegEx.exec(element)
+        let name = dependency[1]
+        name = name.replace('!', '')
+        dependencies[name.trim()] = dependency[3]
+      } else {
+        let name = element
+        name = name.replace('!', ' ')
+        dependencies[name.trim()] = 'UNSPECIFIED'
+      }
+    }
+  }
+
+  return dependencies
+}
+
+const getLockFileRuntimeInfo = lines => {
+  let rubVersionIndex = 0
+  for (let i = 0; i < lines.length; i++) {
+    if (lines[i] === 'RUBY VERSION') {
+      rubVersionIndex = i
+      break
+    }
+  }
+
+  const runtimeDetails = {}
+  if (rubVersionIndex !== 0) {
+    const getRubyVersionArray = lines.slice(rubVersionIndex)
+
+    for (let element of getRubyVersionArray) {
+      if (!isUpperCase(element)) {
+        runtimeDetails['version'] = getVersion(element)
+        runtimeDetails['patchLevel'] = getPatchLevel(element)
+
+        if (element.includes('engine')) {
+          let splitElement = element.split(' ')
+          runtimeDetails[splitElement[0]] = splitElement[1]
+        }
+      }
+    }
+  }
+  return runtimeDetails
+}
+
+const getVersion = element => {
+  const versionRegex = /^([ruby\s0-9.*]+)/
+  if (versionRegex.test(element)) {
+    let version = versionRegex.exec(element)[0]
+
+    if (version.includes('ruby')) {
+      return trimWhiteSpace(version.replace('ruby', ''))
+    }
+  }
+}
+
+const getPatchLevel = element => {
+  const patchLevelRegex = /(p\d+)/
+  if (patchLevelRegex.test(element)) {
+    return patchLevelRegex.exec(element)[0]
+  }
+}
+
+const formatSourceArr = sourceArr => {
+  return sourceArr.map(element => {
+    if (element.sourceType === 'GIT') {
+      delete element.specs
+    }
+
+    if (element.sourceType === 'GEM') {
+      delete element.branch
+      delete element.revision
+      delete element.depthLevel
+      delete element.specs
+    }
+
+    if (element.sourceType === 'PATH') {
+      delete element.branch
+      delete element.revision
+      delete element.depthLevel
+      delete element.specs
+      delete element.platform
+    }
+    return element
+  })
+}
+
+const getSourceArray = (lines, dependencyRegEx) => {
+  const sourceObject = {
+    dependencies: {}
+  }
+
+  const whitespaceRegx = /^(\s*)/
+  let index = 0
+
+  let line = 0
+  const sources = []
+  while ((line = lines[index++]) !== undefined) {
+    let currentWS = whitespaceRegx.exec(line)[1].length
+    if (!line.includes(' bundler (')) {
+      if (currentWS === 0 && !line.includes(':') && line !== '') {
+        sourceObject.sourceType = line
+      }
+
+      if (currentWS !== 0 && line.includes(':')) {
+        nonDependencyKeys(line, sourceObject)
+      }
+
+      if (currentWS > 2) {
+        let nexlineWS = whitespaceRegx.exec(lines[index])[1].length
+        sourceObject.dependencies = buildSourceDependencyWithVersion(
+          whitespaceRegx,
+          dependencyRegEx,
+          line,
+          currentWS,
+          sourceObject.name,
+          sourceObject.dependencies
+        )
+
+        if (currentWS === 4 && sourceObject.depthLevel === undefined) {
+          const dependency = dependencyRegEx.exec(line)
+          sourceObject.name = dependency[1]
+          sourceObject.depthLevel = currentWS
+          populateResolveAndPlatform(dependency[3], sourceObject)
+        }
+
+        if (currentWS === 4 && sourceObject.depthLevel) {
+          // create new Parent
+          const dependency = dependencyRegEx.exec(line)
+          sourceObject.name = dependency[1]
+          sourceObject.depthLevel = currentWS
+          populateResolveAndPlatform(dependency[3], sourceObject)
+        }
+
+        if (
+          (currentWS === 4 && nexlineWS === 4) ||
+          (currentWS === 6 && nexlineWS === 4) ||
+          nexlineWS === ''
+        ) {
+          let newObj = {}
+          newObj = JSON.parse(JSON.stringify(sourceObject))
+          sources.push(newObj)
+          sourceObject.dependencies = {}
+        }
+      }
+    }
+  }
+  return formatSourceArr(sources)
+}
+
+const buildSourceDependencyWithVersion = (
+  whitespaceRegx,
+  dependencyRegEx,
+  line,
+  currentWhiteSpace,
+  name,
+  dependencies
+) => {
+  const isDependencyWithVersion = dependencyRegEx.test(line)
+
+  if (currentWhiteSpace === 6) {
+    const dependency = dependencyRegEx.exec(line)
+    if (isDependencyWithVersion) {
+      if (name !== dependency[1]) {
+        dependencies[dependency[1]] = dependency[3]
+      }
+    } else {
+      dependencies[line.trim()] = 'UNSPECIFIED'
+    }
+  }
+
+  return dependencies
+}
+
+const getRubyDeps = config => {
+  try {
+    const parsedGem = readAndParseGemfile(config.projectPath)
+    const parsedLock = readAndParseGemLockFile(config.projectPath)
+
+    return { gemfilesDependanceies: parsedGem, gemfileLock: parsedLock }
+  } catch (err) {
+    console.log(err.message)
+    process.exit(1)
+  }
+}
+
+const trimWhiteSpace = string => {
+  return string.replace(/\s+/g, '')
+}
+
+const filePathForWindows = path => {
+  if (process.platform === 'win32') {
+    path = path.replace(/\//g, '\\')
+  }
+  return path
+}
+
+module.exports = {
+  getRubyDeps,
+  readAndParseGemfile,
+  readAndParseGemLockFile,
+  nonDependencyKeys,
+  populateResolveAndPlatform,
+  isUpperCase,
+  getDirectDependencies,
+  getLockFileRuntimeInfo,
+  getVersion,
+  getPatchLevel,
+  formatSourceArr,
+  getSourceArray
+}

package/src/scaAnalysis/ruby/index.js

@@ -0,0 +1,11 @@
+const { getRubyDeps } = require('./analysis')
+const { createRubyTSMessage } = require('../common/formatMessage')
+
+const rubyAnalysis = (config, languageFiles) => {
+  const rubyDeps = getRubyDeps(config, languageFiles.RUBY)
+  return createRubyTSMessage(rubyDeps)
+}
+
+module.exports = {
+  rubyAnalysis
+}

package/src/scan/autoDetection.js

@@ -1,5 +1,7 @@
 const i18n = require('i18n')
 const fileFinder = require('./fileUtils')
+const languageResolver = require('../audit/languageAnalysisEngine/reduceIdentifiedLanguages')
+const rootFile = require('../audit/languageAnalysisEngine/getProjectRootFilenames')
 
 const autoDetectFileAndLanguage = async configToUse => {
   const entries = await fileFinder.findFile()
@@ -12,6 +14,11 @@ const autoDetectFileAndLanguage = async configToUse => {
       process.exit(1)
     }
 
+    if (fileFinder.fileIsEmpty(entries[0])) {
+      console.log(i18n.__('scanFileIsEmpty'))
+      process.exit(1)
+    }
+
     configToUse.file = entries[0]
     if (configToUse.name === undefined) {
       configToUse.name = entries[0]
@@ -21,6 +28,38 @@ const autoDetectFileAndLanguage = async configToUse => {
   }
 }
 
+const autoDetectAuditFilesAndLanguages = async () => {
+  let languagesFound = []
+  console.log(i18n.__('searchingAuditFileDirectory', process.cwd()))
+
+  await fileFinder.findFilesJava(languagesFound)
+  await fileFinder.findFilesJavascript(languagesFound)
+  await fileFinder.findFilesPython(languagesFound)
+  await fileFinder.findFilesGo(languagesFound)
+  await fileFinder.findFilesPhp(languagesFound)
+  await fileFinder.findFilesRuby(languagesFound)
+
+  if (languagesFound.length === 1) {
+    return languagesFound
+  } else {
+    console.log(
+      'found multiple languages, please specify one using --file to run SCA analysis'
+    )
+  }
+}
+
+const manualDetectAuditFilesAndLanguages = projectPath => {
+  let projectRootFilenames = rootFile.getProjectRootFilenames(projectPath)
+  let identifiedLanguages =
+    languageResolver.deduceLanguageScaAnalysis(projectRootFilenames)
+
+  if (Object.keys(identifiedLanguages).length === 0) {
+    console.log(i18n.__('languageAnalysisNoLanguage', projectPath))
+    return []
+  }
+  return [identifiedLanguages]
+}
+
 const hasWhiteSpace = s => {
   const filename = s.split('/').pop()
   return filename.indexOf(' ') >= 0
@@ -42,7 +81,25 @@ const errorOnFileDetection = entries => {
   process.exit(1)
 }
 
+const errorOnAuditFileDetection = entries => {
+  if (entries.length > 1) {
+    console.log(i18n.__('searchingDirectoryScan'))
+    for (let file in entries) {
+      console.log('-', entries[file])
+    }
+    console.log('')
+    console.log(i18n.__('specifyFileAuditNotFound'))
+  } else {
+    console.log(i18n.__('noFileFoundScan'))
+    console.log('')
+    console.log(i18n.__('specifyFileAuditNotFound'))
+  }
+}
+
 module.exports = {
   autoDetectFileAndLanguage,
-  errorOnFileDetection
+  errorOnFileDetection,
+  autoDetectAuditFilesAndLanguages,
+  errorOnAuditFileDetection,
+  manualDetectAuditFilesAndLanguages
 }

package/src/scan/fileUtils.js

@@ -11,6 +11,90 @@ const findFile = async () => {
   })
 }
 
+const findFilesJava = async languagesFound => {
+  const result = await fg(
+    ['**/pom.xml', '**/build.gradle', '**/build.gradle.kts'],
+    {
+      dot: false,
+      deep: 1,
+      onlyFiles: true
+    }
+  )
+
+  if (result.length > 0) {
+    return languagesFound.push({ JAVA: result })
+  }
+  return languagesFound
+}
+
+const findFilesJavascript = async languagesFound => {
+  const result = await fg(
+    ['**/package.json', '**/yarn.lock', '**/package.lock.json'],
+    {
+      dot: false,
+      deep: 1,
+      onlyFiles: true
+    }
+  )
+
+  if (result.length > 0) {
+    return languagesFound.push({ JAVASCRIPT: result })
+  }
+  return languagesFound
+}
+
+const findFilesPython = async languagesFound => {
+  const result = await fg(['**/Pipfile.lock', '**/Pipfile'], {
+    dot: false,
+    deep: 3,
+    onlyFiles: true
+  })
+
+  if (result.length > 0) {
+    return languagesFound.push({ PYTHON: result })
+  }
+  return languagesFound
+}
+
+const findFilesGo = async languagesFound => {
+  const result = await fg(['**/go.mod'], {
+    dot: false,
+    deep: 3,
+    onlyFiles: true
+  })
+
+  if (result.length > 0) {
+    return languagesFound.push({ GO: result })
+  }
+  return languagesFound
+}
+
+const findFilesRuby = async languagesFound => {
+  const result = await fg(['**/Gemfile', '**/Gemfile.lock'], {
+    dot: false,
+    deep: 3,
+    onlyFiles: true
+  })
+
+  if (result.length > 0) {
+    return languagesFound.push({ RUBY: result })
+  }
+  return languagesFound
+}
+
+const findFilesPhp = async languagesFound => {
+  const result = await fg(['**/composer.json', '**/composer.lock'], {
+    dot: false,
+    deep: 3,
+    onlyFiles: true
+  })
+
+  if (result.length > 0) {
+    return languagesFound.push({ PHP: result })
+  }
+  return languagesFound
+}
+
 const checkFilePermissions = file => {
   let readableFile = false
   try {
@@ -26,8 +110,22 @@ const fileExists = path => {
   return fs.existsSync(path)
 }
 
+const fileIsEmpty = path => {
+  if (fileExists(path) && checkFilePermissions(path)) {
+    return fs.readFileSync(path).length === 0
+  }
+  return false
+}
+
 module.exports = {
   findFile,
   fileExists,
-  checkFilePermissions
+  checkFilePermissions,
+  findFilesJava,
+  findFilesJavascript,
+  findFilesPython,
+  findFilesGo,
+  findFilesPhp,
+  findFilesRuby,
+  fileIsEmpty
 }